| snort |
ET CURRENT_EVENTS CoGUI Landing Page 2026-07-24 |
rev 1 |
2026-07-24 |
| snort |
ET INFO Adobe Coldfusion POST Request for RDS Services |
rev 1 |
2026-07-24 |
| suricata |
ET INFO Adobe Coldfusion POST Request for RDS Services |
rev 1 |
2026-07-24 |
| suricata |
ET PHISHING CoGUI Landing Page 2026-07-24 |
rev 1 |
2026-07-24 |
| suricata |
ET HUNTING Generic Phish Landing Page 2026-07-24 |
rev 1 |
2026-07-24 |
| sigma |
Network Communication With Crypto Mining Pool |
stable |
2026-07-24 |
| sigma |
Potentially Suspicious Explicit Credential Local Logon |
experimental |
2026-07-23 |
| sigma |
Potentially Suspicious Image Load of Offreg.dll |
experimental |
2026-07-23 |
| sigma |
Sysmon Configuration Error |
test |
2026-07-23 |
| sigma |
Registry Hive File Staged Outside Standard User Profile Path |
experimental |
2026-07-23 |
| sigma |
Suspicious Cross-User Process Spawn |
experimental |
2026-07-23 |
| splunk |
Windows WinSCP Configuration Security Access |
production |
2026-07-22 |
| snort |
ET TROJAN JS ZimReaper Zimbra Mailbox Archive Export |
rev 1 |
2026-07-21 |
| snort |
ET TROJAN JS SpyPress C2 Beacon |
rev 1 |
2026-07-21 |
| snort |
ET SCAN Zimbra Collaboration Global Address List Bulk Enumeration |
rev 1 |
2026-07-21 |
| suricata |
ET MALWARE JS SpyPress C2 Beacon |
rev 1 |
2026-07-21 |
| suricata |
ET MALWARE JS ZimReaper Zimbra Mailbox Archive Export |
rev 1 |
2026-07-21 |
| suricata |
ET SCAN Zimbra Collaboration Global Address List Bulk Enumeration |
rev 1 |
2026-07-21 |
| snort |
ET INFO NGrok Skip Browser Warning Header |
rev 1 |
2026-07-20 |
| suricata |
ET INFO NGrok Skip Browser Warning Header |
rev 1 |
2026-07-20 |
| splunk |
Malicious PowerShell Process - Execution Policy Bypass |
production |
2026-07-20 |
| splunk |
Windows Curl Download to Suspicious Path |
production |
2026-07-20 |
| splunk |
Set Default PowerShell Execution Policy To Unrestricted or Bypass |
production |
2026-07-20 |
| splunk |
Windows PowerShell ScheduleTask |
production |
2026-07-20 |
| splunk |
Windows Mark Of The Web Bypass |
production |
2026-07-20 |
| splunk |
Windows DNS Query Request by Telegram Bot API |
production |
2026-07-20 |
| splunk |
Wscript Or Cscript Suspicious Child Process |
production |
2026-07-20 |
| splunk |
Windows Gather Victim Network Info Through Ip Check Web Services |
production |
2026-07-20 |
| splunk |
Windows Boot or Logon Autostart Execution In Startup Folder |
production |
2026-07-20 |
| splunk |
Detect MSHTA Url in Command Line |
production |
2026-07-20 |
| splunk |
Windows MSI Rollback Script Deleted By Non-Msiexec Process |
production |
2026-07-20 |
| splunk |
Windows Rdp AutomaticDestinations Deletion |
production |
2026-07-20 |
| splunk |
Windows RDP Cache File Deletion |
production |
2026-07-20 |
| splunk |
Windows Mshta Execution In Registry |
production |
2026-07-20 |
| splunk |
Recon AVProduct Through Pwh or WMI |
production |
2026-07-20 |
| splunk |
Domain Controller Discovery with Nltest |
production |
2026-07-20 |
| splunk |
Registry Keys Used For Persistence |
production |
2026-07-20 |
| splunk |
Windows Suspicious Defender Update Activity in INetCache |
production |
2026-07-20 |
| sigma |
Rundll32 UNC Path Execution |
test |
2026-07-20 |
| sigma |
WordPress Wp2shell Exploitation Tool User-Agent |
experimental |
2026-07-19 |