| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ezgateway .net domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.starnightimport .com domain |
rev 1 |
2026-04-27 |
| snort |
ET TROJAN TA582 CnC Checkin |
rev 2 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.opik .net domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.opik .net domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dynu .org |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dynu .net |
rev 1 |
2026-04-27 |
| snort |
ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement |
rev 2 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.starnightimport .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.roxa .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.yyuyy .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dynu .net |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.yyuyy .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET MALWARE TA582 CnC Checkin |
rev 2 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.rabsacca .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dynu .org |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dynu .net |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ezgateway .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.roxa .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.opik .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.rabsacca .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.opik .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ezgateway .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET INFO Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement |
rev 2 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.starnightimport .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dynu .org |
rev 1 |
2026-04-27 |
| splunk |
Windows MsMpEng Writing to System32 |
production |
2026-04-27 |
| splunk |
Windows Suspicious Defender Engine or Signature Files Created |
production |
2026-04-27 |
| splunk |
Windows Non-System Process Querying Definition Update |
production |
2026-04-27 |
| sigma |
Okta 2023 Breach Indicator Of Compromise |
test |
2026-04-27 |
| sigma |
Service Startup Type Change Via Wmic.EXE |
experimental |
2026-04-27 |
| sigma |
PUA - Memory Dump Mount Via MemProcFS |
experimental |
2026-04-27 |
| sigma |
New Okta User Created |
test |
2026-04-27 |
| sigma |
Okta Application Sign-On Policy Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta Application Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta New Admin Console Behaviours |
test |
2026-04-27 |