| splunk |
Windows Access Token Winlogon Duplicate Handle In Uncommon Path |
production |
2026-09-08 |
| splunk |
Detect Credential Dumping through LSASS access |
production |
2026-09-08 |
| splunk |
Windows Access Token Manipulation Winlogon Duplicate Token Handle |
production |
2026-09-08 |
| splunk |
Cisco IOS XE WebUI Programmatic Configuration |
production |
2026-09-08 |
| splunk |
Email files written outside of the Outlook directory |
production |
2026-09-08 |
| splunk |
ESXi Audit Tampering |
production |
2026-09-08 |
| elastic |
Potential Fileless Execution via Unusual memfd Create Call |
production |
2026-09-08 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ortodont-katalinic .com domain |
rev 1 |
2026-09-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ortodont-katalinic .com domain |
rev 1 |
2026-09-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ortodont-katalinic .com domain |
rev 1 |
2026-09-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ortodont-katalinic .com domain |
rev 1 |
2026-09-07 |
| splunk |
Windows Content Copied from Browser was Executed |
production |
2026-09-07 |
| elastic |
Potential Fileless Execution via O_TMPFILE |
production |
2026-09-07 |
| snort |
ET CURRENT_EVENTS TA2726 CnC Request to Fake Wordpress Plugin M1 |
rev 1 |
2026-09-04 |
| snort |
ET CURRENT_EVENTS BlueMoon EK JS Loader M3 |
rev 1 |
2026-09-04 |
| snort |
ET CURRENT_EVENTS BlueMoon EK JS Loader M1 |
rev 1 |
2026-09-04 |
| snort |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound M2 |
rev 1 |
2026-09-04 |
| snort |
ET CURRENT_EVENTS BlueMoon EK JS Loader M2 |
rev 1 |
2026-09-04 |
| suricata |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound M2 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT BlueMoon EK JS Loader M3 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT TA2726 CnC Request to Fake Wordpress Plugin M1 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT TA2726 CnC Response from admin-ajax.php |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT BlueMoon EK JS Loader M1 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT BlueMoon EK JS Loader M2 |
rev 1 |
2026-09-04 |
| snort |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound |
rev 1 |
2026-09-03 |
| suricata |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound |
rev 1 |
2026-09-03 |
| splunk |
Linux Crontab Enumeration |
production |
2026-09-03 |
| splunk |
MacOS AppleScript Shell Execution and Compilation |
production |
2026-09-03 |
| splunk |
PowerShell 4104 Hunting |
production |
2026-09-03 |
| suricata |
ET MALWARE TonRAT CnC Request to TonAPI Dead Drop Resolver |
rev 1 |
2026-09-02 |
| splunk |
MacOS Account Created |
production |
2026-09-01 |
| splunk |
Linux Data Destruction Command |
production |
2026-09-01 |
| splunk |
Icacls Deny Command |
production |
2026-09-01 |
| splunk |
MacOS Data Chunking |
production |
2026-09-01 |
| splunk |
Windows Unusual SysWOW64 Process Run System32 Executable |
production |
2026-09-01 |
| splunk |
Citrix ADC Exploitation CVE-2023-3519 |
production |
2026-09-01 |
| splunk |
Windows TinyCC Shellcode Execution |
production |
2026-09-01 |
| splunk |
Windows Process Execution in Temp Dir |
production |
2026-09-01 |
| splunk |
Windows Suspicious Process File Path |
production |
2026-09-01 |
| splunk |
Linux Ghostscript Exploitation |
production |
2026-09-01 |