| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.brianneburnell .com domain |
rev 1 |
2026-09-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cthulhu .li domain |
rev 1 |
2026-09-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cthulhu .li domain |
rev 1 |
2026-09-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.brianneburnell .com domain |
rev 1 |
2026-09-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.brianneburnell .com domain |
rev 1 |
2026-09-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cthulhu .li domain |
rev 1 |
2026-09-21 |
| suricata |
ET MALWARE GateSentinel C2 RemoteTool Heartbeat |
rev 1 |
2026-09-21 |
| suricata |
ET MALWARE GateSentinel C2 RemoteTool Registration |
rev 1 |
2026-09-21 |
| snort |
ET TROJAN GateSentinel C2 RemoteTool Registration |
rev 1 |
2026-09-21 |
| snort |
ET TROJAN GateSentinel C2 RemoteTool Heartbeat |
rev 1 |
2026-09-21 |
| splunk |
Windows Process Injection into Notepad |
deprecated |
2026-09-21 |
| splunk |
Windows Eventlog Cleared Via Wevtutil |
production |
2026-09-21 |
| splunk |
Creation of lsass Dump with Taskmgr |
production |
2026-09-21 |
| splunk |
Suspicious wevtutil Usage |
production |
2026-09-21 |
| elastic |
RPC (Remote Procedure Call) from the Internet |
production |
2026-09-21 |
| elastic |
RPC (Remote Procedure Call) to the Internet |
production |
2026-09-21 |
| elastic |
SMB (Windows File Sharing) Activity from the Internet |
production |
2026-09-21 |
| elastic |
SMB (Windows File Sharing) Activity to the Internet |
production |
2026-09-21 |
| elastic |
Accepted Default Telnet Port Connection |
production |
2026-09-21 |
| splunk |
MacOS Osascript Executing Interactive Shell |
production |
2026-09-18 |
| splunk |
MacOS Osascript Executing JavaScript Code With ObjC |
production |
2026-09-18 |
| splunk |
Cisco NVM - Osascript Network Connection for a Long Duration |
production |
2026-09-18 |
| elastic |
Potential Tunneling via AWS IoT Secure Tunneling Localproxy |
production |
2026-09-18 |
| splunk |
MacOS - Re-opened Applications |
deprecated |
2026-09-18 |
| elastic |
Potential Cluster Enumeration via jq Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual Destination Port |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual Region |
production |
2026-09-18 |
| elastic |
Spike in Bytes Sent to an External Device |
production |
2026-09-18 |
| elastic |
Spike in Bytes Sent to an External Device via Airdrop |
production |
2026-09-18 |
| elastic |
Unusual Process Writing Data to an External Device |
production |
2026-09-18 |
| elastic |
Machine Learning Detected DGA activity using a known SUNBURST DNS domain |
production |
2026-09-18 |
| elastic |
Potential DGA Activity |
production |
2026-09-18 |
| elastic |
Base16 or Base32 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-09-18 |
| elastic |
AppArmor Profile Compilation via apparmor_parser |
production |
2026-09-18 |
| elastic |
AppArmor Policy Violation Detected |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a DNS Request With a High DGA Probability Score |
production |
2026-09-18 |