| suricata |
ET INFO Observed DNS Query to DDNS Domain .zzux .com |
rev 1 |
2021-06-09 |
| suricata |
ET MALWARE Observed DNS Query to Known Gelsemium CnC |
rev 1 |
2021-06-09 |
| suricata |
ET MALWARE Observed DNS Query to Known Gelsemium CnC |
rev 1 |
2021-06-09 |
| suricata |
ET INFO Observed DNS Query to DDNS Domain .dns1 .us |
rev 1 |
2021-06-09 |
| snort |
ET EXPLOIT XXL-Job RCE |
rev 1 |
2021-06-08 |
| snort |
ET INFO Unix/Linux Processhider Source Being Downloaded |
rev 1 |
2021-06-08 |
| suricata |
ET EXPLOIT XXL-Job RCE |
rev 1 |
2021-06-08 |
| snort |
ET TROJAN Win32/PlagueBot User-Agent |
rev 1 |
2021-06-07 |
| snort |
ET TROJAN ETag HTTP Header Observed at CNCERT Sinkhole |
rev 1 |
2021-06-07 |
| snort |
ET TROJAN ETag HTTP Header Observed at JPCERT Sinkhole |
rev 1 |
2021-06-07 |
| snort |
ET TROJAN Known Sinkhole Response Header |
rev 1 |
2021-06-07 |
| snort |
ET TROJAN MSIL/NoCry Ransomware Checkin Via Discord |
rev 1 |
2021-06-07 |
| snort |
ET TROJAN Known Sinkhole Response Header |
rev 1 |
2021-06-07 |
| snort |
ET TROJAN FatalRAT CnC Activity |
rev 2 |
2021-06-04 |
| suricata |
ET MALWARE FatalRAT CnC Activity |
rev 2 |
2021-06-04 |
| snort |
ET TROJAN SharpPanda APT Maldoc Activity |
rev 2 |
2021-06-03 |
| snort |
ET TROJAN APT34 Related DNS Tunneling Activity |
rev 2 |
2021-06-03 |
| snort |
ET TROJAN CNRarypt Ransomware CnC Activity |
rev 1 |
2021-06-03 |
| suricata |
ET MALWARE APT34 Related DNS Tunneling Activity |
rev 2 |
2021-06-03 |
| snort |
ET TROJAN Vidar Stealer - FaceIt Checkin Response |
rev 1 |
2021-06-02 |
| snort |
ET CURRENT_EVENTS Secure Email Portal Lure Landing Page |
rev 3 |
2021-06-02 |
| suricata |
ET MALWARE Vidar Stealer - FaceIt Checkin Response |
rev 1 |
2021-06-02 |
| suricata |
ET PHISHING Secure Email Portal Lure Landing Page |
rev 3 |
2021-06-02 |
| snort |
ET CURRENT_EVENTS Observed UK Gov Support Landing 2021-06-01 |
rev 2 |
2021-06-01 |
| snort |
ET CURRENT_EVENTS PerSwaysion Landing Page M3 |
rev 2 |
2021-06-01 |
| snort |
ET MOBILE_MALWARE Kimsuky AppleSeed CnC Checkin |
rev 1 |
2021-06-01 |
| suricata |
ET PHISHING PerSwaysion Landing Page M3 |
rev 2 |
2021-06-01 |
| sigma |
Zerologon Exploitation Using Well-known Tools |
stable |
2021-05-30 |
| snort |
ET INFO POST to Double Slash in URI |
rev 2 |
2021-05-28 |
| snort |
ET CURRENT_EVENTS PerSwaysion JavaScript Response M1 |
rev 3 |
2021-05-28 |
| snort |
ET CURRENT_EVENTS Possible Phishing Landing Page 2021-05-24 |
rev 1 |
2021-05-28 |
| snort |
ET CURRENT_EVENTS PerSwaysion JavaScript Response M2 |
rev 2 |
2021-05-28 |
| snort |
ET CURRENT_EVENTS PerSwaysion Landing Page M2 |
rev 2 |
2021-05-28 |
| suricata |
ET PHISHING PerSwaysion JavaScript Response M1 |
rev 3 |
2021-05-28 |
| suricata |
ET PHISHING PerSwaysion Landing Page M2 |
rev 2 |
2021-05-28 |
| suricata |
ET PHISHING PerSwaysion JavaScript Response M2 |
rev 2 |
2021-05-28 |
| snort |
ET TROJAN Unknown Actor Targeting Minority Groups CnC Activity |
rev 1 |
2021-05-27 |
| snort |
ET CURRENT_EVENTS PerSwaysion Landing Page M1 |
rev 1 |
2021-05-27 |
| suricata |
ET PHISHING PerSwaysion Landing Page M1 |
rev 1 |
2021-05-27 |
| suricata |
ET MALWARE Unknown Actor Targeting Minority Groups CnC Activity |
rev 1 |
2021-05-27 |