| suricata |
ET INFO Telegram 409 Error Response, Failed Fetch /getUpdates due to Multiple Bot Instances |
rev 1 |
2026-05-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.srivaishnavam .org .au domain |
rev 1 |
2026-05-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.srivaishnavam .org .au domain |
rev 1 |
2026-05-27 |
| suricata |
ET ATTACK_RESPONSE MacSync Stealer Stage 2 Payload Inbound |
rev 1 |
2026-05-27 |
| snort |
ET CURRENT_EVENTS Generic Fake Document Landing Page Hosted On kuse .ai |
rev 1 |
2026-05-26 |
| snort |
ET CURRENT_EVENTS Generic Fake Document Landing Page 2026-05-26 |
rev 1 |
2026-05-26 |
| snort |
ET CURRENT_EVENTS O365 Phishing Landing Page Observed |
rev 1 |
2026-05-26 |
| suricata |
ET PHISHING Generic Fake Document Landing Page Hosted On kuse .ai |
rev 1 |
2026-05-26 |
| suricata |
ET PHISHING O365 Phishing Landing Page Observed |
rev 1 |
2026-05-26 |
| suricata |
ET PHISHING Generic Fake Document Landing Page 2026-05-26 |
rev 1 |
2026-05-26 |
| snort |
ET WEB_SPECIFIC_APPS Apache HertzBeat 1.8.0 Authenticated Remote Code Execution |
rev 1 |
2026-05-22 |
| suricata |
ET WEB_SPECIFIC_APPS Apache HertzBeat 1.8.0 Authenticated Remote Code Execution |
rev 1 |
2026-05-22 |
| sigma |
Clipboard Access Via OSAScript |
test |
2026-05-22 |
| snort |
ET CURRENT_EVENTS Operation HookedWing Form Injection Payload Request |
rev 1 |
2026-05-21 |
| snort |
ET TROJAN implant.js Linux Beacon Check-in |
rev 3 |
2026-05-21 |
| snort |
ET TROJAN implant.js Windows Beacon Check-in |
rev 3 |
2026-05-21 |
| snort |
ET CURRENT_EVENTS Operation HookedWing Landing Page Observed |
rev 1 |
2026-05-21 |
| suricata |
ET MALWARE implant.js Linux Beacon Check-in |
rev 3 |
2026-05-21 |
| suricata |
ET MALWARE implant.js Windows Beacon Check-in |
rev 3 |
2026-05-21 |
| suricata |
ET PHISHING Operation HookedWing Landing Page Observed |
rev 1 |
2026-05-21 |
| suricata |
ET PHISHING Operation HookedWing Form Injection Payload Request |
rev 1 |
2026-05-21 |
| sigma |
MacOS Scripting Interpreter AppleScript |
test |
2026-05-21 |
| sigma |
Signed DLL Loaded With Missing PE Version Metadata |
experimental |
2026-05-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| splunk |
Windows FFmpeg DirectShow Video Capture |
production |
2026-05-20 |
| splunk |
Cisco IOS XE VTY Access Class Tampering |
production |
2026-05-20 |
| splunk |
Windows FFmpeg Audio and Video Device Discovery |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Tunnel Interface Configuration |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Request Platform Package Describe Shell Pattern |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Guestshell Activation and Destroy |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Reconnaissance Command Activity |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Remote Access Probe Burst |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal |
production |
2026-05-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |