| splunk |
Cisco IOS XE WebUI Login From IOSd Local Port |
production |
2026-05-19 |
| snort |
ET ATTACK_RESPONSE ScreenConnect RMM Payload Delivered via Fake Docusign Page |
rev 1 |
2026-05-18 |
| snort |
ET CURRENT_EVENTS Phish Link Click Confirmation via Telegram Bot |
rev 1 |
2026-05-18 |
| snort |
ET ATTACK_RESPONSE RMM Payload Delivery Page Observed |
rev 1 |
2026-05-18 |
| suricata |
ET ATTACK_RESPONSE ScreenConnect RMM Payload Delivered via Fake Docusign Page |
rev 1 |
2026-05-18 |
| suricata |
ET ATTACK_RESPONSE RMM Payload Delivery Page Observed |
rev 1 |
2026-05-18 |
| suricata |
ET PHISHING Phish Link Click Confirmation via Telegram Bot |
rev 1 |
2026-05-18 |
| splunk |
Windows Cloud Files Filter Loaded by Uncommon Process |
production |
2026-05-18 |
| sigma |
Potential Vcruntime140 DLL Sideloading |
experimental |
2026-05-18 |
| sigma |
Potentially Suspicious WDAC Policy File Creation |
experimental |
2026-05-18 |
| sigma |
Creation of WerFault.exe/Wer.dll in Unusual Folder |
test |
2026-05-18 |
| sigma |
File And SubFolder Enumeration Via Dir Command |
test |
2026-05-18 |
| sigma |
Suspicious Start-Process PassThru |
test |
2026-05-18 |
| snort |
ET EXPLOIT IBM Data Risk Manager Arbitrary File Download Attempt |
rev 3 |
2026-05-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| snort |
ET TROJAN Wordpress Social Warfare Plugin Attempted Admin User Creation |
rev 2 |
2026-05-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| suricata |
ET MALWARE Wordpress Social Warfare Plugin Attempted Admin User Creation |
rev 2 |
2026-05-15 |
| suricata |
ET EXPLOIT IBM Data Risk Manager Arbitrary File Download Attempt |
rev 2 |
2026-05-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN Observed Sainbox Domain in TLS SNI |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN SainboxRAT CnC Checkin |
rev 1 |
2026-05-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN SainboxRAT CnC Config Request |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN Observed DNS Query to Sainbox Domain |
rev 1 |
2026-05-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE Observed DNS Query to Sainbox Domain |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE Observed Sainbox Domain in TLS SNI |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE SainboxRAT CnC Checkin |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE SainboxRAT CnC Config Request |
rev 1 |
2026-05-14 |
| splunk |
Splunk XSS Privilege Escalation via Custom Urls in Dashboard |
production |
2026-05-14 |
| splunk |
Splunk User Enumeration Attempt |
production |
2026-05-14 |
| splunk |
Splunk RCE via User XSLT |
production |
2026-05-14 |