| sigma |
Antivirus - Web Shell Detection Signature |
test |
2026-06-29 |
| sigma |
Renamed Sysinternals Sdelete Execution |
test |
2026-06-29 |
| sigma |
Usage of Renamed Sysinternals Tools - RegistrySet |
test |
2026-06-29 |
| sigma |
Amsi.DLL Load By Uncommon Process |
test |
2026-06-29 |
| sigma |
WMI Module Loaded By Uncommon Process |
test |
2026-06-29 |
| sigma |
Suspicious Service Installed |
test |
2026-06-29 |
| sigma |
Suspicious Execution Of Renamed Sysinternals Tools - Registry |
test |
2026-06-29 |
| sigma |
Renamed ProcDump Execution |
test |
2026-06-29 |
| sigma |
Potential Defense Evasion Via Rename Of Highly Relevant Binaries |
test |
2026-06-29 |
| sigma |
Permission Check Via Accesschk.EXE |
test |
2026-06-29 |
| sigma |
Procdump Execution |
test |
2026-06-29 |
| sigma |
Suspicious Use of PsLogList |
test |
2026-06-29 |
| sigma |
Sysinternals PsService Execution |
test |
2026-06-29 |
| sigma |
Sysinternals PsSuspend Execution |
test |
2026-06-29 |
| sigma |
Sysinternals PsSuspend Suspicious Execution |
test |
2026-06-29 |
| sigma |
Sysmon Configuration Update |
test |
2026-06-29 |
| sigma |
Uninstall Sysinternals Sysmon |
test |
2026-06-29 |
| sigma |
HackTool - SysmonEnte Execution |
test |
2026-06-29 |
| sigma |
Potential Credential Dumping Activity Via LSASS |
test |
2026-06-29 |
| sigma |
Potentially Suspicious GrantedAccess Flags On LSASS |
test |
2026-06-29 |
| splunk |
PowerShell Domain Enumeration |
production |
2026-06-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| snort |
ET INFO Javascript Mobile Device Check |
rev 1 |
2026-06-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| suricata |
ET EXPLOIT_KIT ErrTraffic Beer Cluster Checkin |
rev 1 |
2026-06-26 |
| suricata |
ET HUNTING FakeUpdate Injector Script Request |
rev 1 |
2026-06-26 |
| suricata |
ET HUNTING Javascript Mobile Device Check |
rev 1 |
2026-06-26 |
| suricata |
ET HUNTING CoGUI Fingerprint Activity |
rev 1 |
2026-06-25 |
| splunk |
Windows File Transfer Protocol In Non-Common Process Path |
production |
2026-06-25 |
| splunk |
Windows Unusual Process Load Mozilla NSS-Mozglue Module |
production |
2026-06-25 |
| splunk |
Windows Disable or Modify Tools Via Taskkill |
production |
2026-06-25 |
| splunk |
Headless Browser Usage |
production |
2026-06-25 |
| splunk |
Windows Unusual FileZilla XML Config Access |
production |
2026-06-25 |
| splunk |
Windows Credentials from Password Stores Chrome Copied in TEMP Dir |
production |
2026-06-25 |