| snort |
ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server |
rev 3 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M4 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M9 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M10 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M3 |
rev 1 |
2026-08-13 |
| suricata |
ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server |
rev 3 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M5 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M10 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M7 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M1 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M4 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M6 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M9 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M3 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M8 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M2 |
rev 1 |
2026-08-13 |
| elastic |
Deprecated - M365 Security Compliance Email Reported by User as Malware or Phish |
deprecated |
2026-08-13 |
| sigma |
New User Account Creation Attempt Via ADSI in CommandLine |
experimental |
2026-08-13 |
| sigma |
New User Account Creation Attempt Via ADSI |
experimental |
2026-08-13 |
| splunk |
Linux Possible Append Command To Profile Config File |
production |
2026-08-12 |
| splunk |
ESXi Encryption Settings Modified |
production |
2026-08-12 |
| splunk |
Ping Sleep Batch Command |
production |
2026-08-11 |
| splunk |
Windows Set Account Password Policy To Unlimited Via Net |
production |
2026-08-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| snort |
ET CURRENT_EVENTS TA2730 Javascript Request 2026-08-06 |
rev 1 |
2026-08-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| suricata |
ET PHISHING Generic AiTM Fingerprint Exfil |
rev 1 |
2026-08-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| suricata |
ET PHISHING TA2730 Javascript Request 2026-08-06 |
rev 1 |
2026-08-07 |
| sigma |
Potentially Suspicious Mofcomp Execution |
test |
2026-08-06 |
| splunk |
Windows Registry Dotnet ETW Disabled Via ENV Variable |
production |
2026-08-05 |
| splunk |
Network Share Discovery Via Dir Command |
production |
2026-08-05 |
| splunk |
High Frequency Copy Of Files In Network Share |
production |
2026-08-05 |
| splunk |
Windows User Discovery Via Net |
production |
2026-08-05 |
| splunk |
Executable File Written in Administrative SMB Share |
production |
2026-08-05 |