| sigma |
Okta Identity Provider Created |
test |
2026-04-27 |
| sigma |
Okta Admin Role Assignment Created |
test |
2026-04-27 |
| sigma |
Okta Policy Rule Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta Suspicious Activity Reported by End-user |
test |
2026-04-27 |
| sigma |
Okta Unauthorized Access to App |
test |
2026-04-27 |
| sigma |
Okta Security Threat Detected |
test |
2026-04-27 |
| sigma |
Okta FastPass Phishing Detection |
test |
2026-04-27 |
| sigma |
New Okta User Created |
test |
2026-04-27 |
| sigma |
Okta Admin Role Assigned to an User or Group |
test |
2026-04-27 |
| sigma |
Okta Application Sign-On Policy Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta Application Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta API Token Revoked |
test |
2026-04-27 |
| sigma |
Okta API Token Created |
test |
2026-04-27 |
| sigma |
PUA - Memory Dump Mount Via MemProcFS |
experimental |
2026-04-27 |
| sigma |
Service Startup Type Change Via Wmic.EXE |
experimental |
2026-04-27 |
| sigma |
Okta 2023 Breach Indicator Of Compromise |
test |
2026-04-27 |
| sigma |
Indirect Command Execution via SFTP ProxyCommand |
experimental |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.thehor .com domain |
rev 1 |
2026-04-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thehor .com domain |
rev 1 |
2026-04-25 |
| snort |
ET TROJAN APT36 Victim Beacon M2 |
rev 1 |
2026-04-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| snort |
ET TROJAN APT36 Victim Beacon M1 |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| suricata |
ET MALWARE APT36 Victim Beacon M2 |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| suricata |
ET MALWARE APT36 Victim Beacon M1 |
rev 1 |
2026-04-24 |
| snort |
ET TROJAN TeamPCP CanisterWorm - Namastex npm Campaign - Exfiltration |
rev 1 |
2026-04-23 |
| suricata |
ET MALWARE TeamPCP CanisterWorm - Namastex npm Campaign - Exfiltration |
rev 1 |
2026-04-23 |
| snort |
ET TROJAN MakinoLoader Tasking Request |
rev 1 |
2026-04-21 |
| snort |
ET TROJAN MakinoLoader CnC Checkin Attempt |
rev 1 |
2026-04-21 |
| snort |
ET TROJAN MakinoLoader EDR Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| snort |
ET TROJAN MakinoLoader Systeminfo Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sulekutlay .com domain |
rev 1 |
2026-04-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sulekutlay .com domain |
rev 1 |
2026-04-21 |
| suricata |
ET MALWARE MakinoLoader Tasking Request |
rev 1 |
2026-04-21 |