| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.chanka .com domain |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed DarkSword EK Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed Exploit Kit Profiler Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed Exploit Kit Profiler Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed BlueMoon EK CnC Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN AMOS ClickFix Campaign - Bash Stager M1 |
rev 1 |
2026-09-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.robertschulze .org domain |
rev 1 |
2026-09-17 |
| snort |
ET CURRENT_EVENTS Generic Phish Request to RMM M1 2026-09-16 |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed Exploit Kit Profiler Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| snort |
ET INFO External IP Lookup - ipleak .net |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved for agentDownloadURL |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed DarkSword EK Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Exfil User Fingerprint |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Outbound Command Sent |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed DNS Query to BlueMoon EK CnC |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed Cobalt Strike CnC Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.robertschulze .org domain |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Registration |
rev 1 |
2026-09-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.robertschulze .org domain |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed BlueMoon EK CnC Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed DarkSword EK Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| suricata |
ET INFO External IP Lookup - ipleak .net |
rev 1 |
2026-09-17 |
| suricata |
ET PHISHING Generic Phish Request to RMM M1 2026-09-16 |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Exfil User Fingerprint |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed CobaltStrike CnC Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed BlueMoon EK CnC Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE AMOS ClickFix Campaign - Bash Stager M1 |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Outbound Command Sent |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed Exploit Kit Profiler Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed DNS Query to BlueMoon EK CnC |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed Exploit Kit Profiler Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed DarkSword EK Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.robertschulze .org domain |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed BlueMoon EK CnC Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.chanka .com domain |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed Exploit Kit Profiler Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE Observed Exploit Kit Profiler Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| suricata |
ET PHISHING Generic Phish Request to RMM M2 2026-09-16 |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved for agentDownloadURL |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Registration |
rev 1 |
2026-09-17 |