| splunk |
Windows Non Discord App Access Discord LevelDB |
production |
2026-06-25 |
| splunk |
Powershell Fileless Script Contains Base64 Encoded Content |
production |
2026-06-25 |
| splunk |
Windows Powershell Cryptography Namespace |
production |
2026-06-25 |
| splunk |
Suspicious Process With Discord DNS Query |
production |
2026-06-25 |
| splunk |
Windows Browser Process Launched with Unusual Flags |
production |
2026-06-25 |
| splunk |
Windows System Network Connections Discovery Netsh |
production |
2026-06-25 |
| splunk |
Windows Chromium Browser with Custom User Data Directory |
production |
2026-06-25 |
| splunk |
Windows Chromium Browser No Security Sandbox Process |
production |
2026-06-25 |
| splunk |
Windows Disable or Modify Tools Via Taskkill |
production |
2026-06-25 |
| splunk |
Splunk Authentication Token Exposure in Debug Log |
production |
2026-06-24 |
| snort |
ET INFO Automox RMM Installer Downloaded From 3rd Party |
rev 1 |
2026-06-23 |
| suricata |
ET HUNTING Automox RMM Installer Downloaded From 3rd Party |
rev 1 |
2026-06-23 |
| splunk |
Splunk RCE Through Arbitrary File Write to Windows System Root |
production |
2026-06-23 |
| snort |
ET TROJAN GoldenGh0stLoader Websocket Checkin - C2 Response |
rev 1 |
2026-06-22 |
| snort |
ET TROJAN GoldenGh0stLoader Directory Listing Command From C2 |
rev 1 |
2026-06-22 |
| suricata |
ET MALWARE GoldenGh0stLoader Directory Listing Command From C2 |
rev 1 |
2026-06-22 |
| suricata |
ET MALWARE GoldenGh0stLoader Websocket Checkin - C2 Response |
rev 1 |
2026-06-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| sigma |
Process Execution From Shared Memory Directory |
experimental |
2026-06-20 |
| sigma |
Registry Enumeration via WMI Stdregprov |
experimental |
2026-06-19 |
| sigma |
Registry Manipulation via WMI Stdregprov |
experimental |
2026-06-19 |
| sigma |
NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE |
test |
2026-06-19 |
| suricata |
ET PHISHING Attacker Polling for Device Code Verification |
rev 1 |
2026-06-18 |
| sigma |
CobaltStrike Named Pipe Pattern Regex |
test |
2026-06-18 |
| snort |
ET TROJAN RevStealer dl_exec Command from C2 |
rev 1 |
2026-06-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.juk .fi domain |
rev 1 |
2026-06-17 |
| snort |
ET EXPLOIT Balada Javascript Inject Observed |
rev 1 |
2026-06-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.juk .fi domain |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer Data Exfiltration Attempt M2 |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer Data Exfiltration Attempt M1 |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer Sync Request |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer CnC Checkin |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer Sync Request |
rev 1 |
2026-06-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.juk .fi domain |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer dl_exec Command from C2 |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer CnC Checkin |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer Data Exfiltration Attempt M2 |
rev 1 |
2026-06-17 |