| snort |
ET INFO Redirect to MSP360 Software Download Request M1 |
rev 1 |
2026-01-26 |
| snort |
ET INFO NTLMv1 Session Setup Response - Challenge |
rev 1 |
2026-01-26 |
| snort |
ET INFO NTLM Session Setup Request - Auth |
rev 1 |
2026-01-26 |
| suricata |
ET INFO NTLMv1 Session Setup Response - Challenge |
rev 1 |
2026-01-26 |
| suricata |
ET HUNTING Large non-DNS Packet on Port 53 |
rev 1 |
2026-01-26 |
| suricata |
ET INFO NTLM Session Setup Request - Negotiate |
rev 1 |
2026-01-26 |
| suricata |
ET INFO NTLM Session Setup Request - Auth |
rev 1 |
2026-01-26 |
| suricata |
ET INFO Download Request for MSP360 Software |
rev 1 |
2026-01-26 |
| suricata |
ET INFO Redirect to MSP360 Software Download Request M1 |
rev 1 |
2026-01-26 |
| suricata |
ET INFO POST to MSP360 Backup Services |
rev 1 |
2026-01-26 |
| sigma |
Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine |
experimental |
2026-01-26 |
| sigma |
Windows Vulnerable Driver Blocklist Disabled |
experimental |
2026-01-26 |
| sigma |
Vulnerable Driver Blocklist Registry Tampering Via CommandLine |
experimental |
2026-01-26 |
| sigma |
Suspicious Shell Open Command Registry Modification |
experimental |
2026-01-24 |
| sigma |
Shai-Hulud Malicious GitHub Workflow Creation |
experimental |
2026-01-24 |
| sigma |
XSL Script Execution Via WMIC.EXE |
test |
2026-01-24 |
| sigma |
Registry Modification for OCI DLL Redirection |
experimental |
2026-01-24 |
| sigma |
Potential Remote SquiblyTwo Technique Execution |
test |
2026-01-24 |
| sigma |
Capabilities Discovery - Linux |
test |
2026-01-24 |
| sigma |
Creation Of Non-Existent System DLL |
test |
2026-01-24 |
| sigma |
Cmd Launched with Hidden Start Flags to Suspicious Targets |
experimental |
2026-01-24 |
| sigma |
Potential DLL Sideloading Of Non-Existent DLLs From System Folders |
test |
2026-01-24 |
| sigma |
Linux Setgid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| sigma |
Registry Modification of MS-settings Protocol Handler |
test |
2026-01-24 |
| sigma |
Linux Setuid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| snort |
ET CURRENT_EVENTS Microsoft Phish Landing Page M1 2026-01-22 |
rev 1 |
2026-01-22 |
| snort |
ET TROJAN HTTP Request to Known Stealer Payload Delivery Host |
rev 1 |
2026-01-22 |
| suricata |
ET PHISHING Microsoft Phish Landing Page M1 2026-01-22 |
rev 1 |
2026-01-22 |
| suricata |
ET MALWARE HTTP Request to Known Stealer Payload Delivery Host |
rev 1 |
2026-01-22 |
| snort |
ET CURRENT_EVENTS EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| snort |
ET TROJAN EvilNginx Fake Captcha Page Request |
rev 1 |
2026-01-21 |
| snort |
ET CURRENT_EVENTS EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| suricata |
ET PHISHING EvilNginx Fake Captcha Page Request |
rev 1 |
2026-01-21 |
| suricata |
ET PHISHING EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| suricata |
ET PHISHING EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| snort |
ET INFO SonicWall SMA Multiple CIFS Server Bookmark Creation |
rev 2 |
2026-01-20 |
| snort |
ET EXPLOIT F5 BIG-IP - Password Reset Attempt - Observed Post CVE-2023-46747 Activity |
rev 3 |
2026-01-20 |
| snort |
ET INFO Dropbox paper Document Request Observed |
rev 2 |
2026-01-20 |
| snort |
ET INFO Liferay JSON Web Services Invoker |
rev 3 |
2026-01-20 |
| snort |
ET INFO Possible NOP Sled Observed in Large DNS over TCP Packet M2 |
rev 2 |
2026-01-20 |