| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M14 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M19 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M12 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M13 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M20 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M18 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M11 |
rev 1 |
2026-08-14 |
| splunk |
Windows Query Registry UnInstall Program List |
production |
2026-08-14 |
| splunk |
Windows Access Token Manipulation SeDebugPrivilege |
production |
2026-08-14 |
| splunk |
Executables Or Script Creation In Suspicious Path |
production |
2026-08-14 |
| splunk |
Windows Process Injection Remote Thread |
production |
2026-08-14 |
| splunk |
Non Chrome Process Accessing Chrome Default Dir |
production |
2026-08-14 |
| splunk |
Non Firefox Process Access Firefox Profile Dir |
production |
2026-08-14 |
| splunk |
Windows Disable or Stop Browser Process |
production |
2026-08-14 |
| splunk |
Windows Screen Capture in TEMP folder |
production |
2026-08-14 |
| splunk |
Windows Credentials from Password Stores Chrome Login Data Access |
production |
2026-08-14 |
| splunk |
Windows Credentials from Password Stores Chrome LocalState Access |
production |
2026-08-14 |
| splunk |
Windows Credentials from Password Stores Chrome Extension Access |
production |
2026-08-14 |
| splunk |
Windows Indicator Removal Via Rmdir |
production |
2026-08-14 |
| splunk |
Executables Or Script Creation In Temp Path |
production |
2026-08-14 |
| elastic |
AWS GetFederationToken Followed by Console Login via Federation Exchange |
production |
2026-08-14 |
| sigma |
AWS IAM Backdoor Users Keys |
test |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M5 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M9 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M2 |
rev 1 |
2026-08-13 |
| snort |
ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server |
rev 3 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M4 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M6 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M8 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M7 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M10 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M1 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M3 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M2 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M4 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M6 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M7 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M10 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M3 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M8 |
rev 1 |
2026-08-13 |