| suricata |
ET PHISHING GhostFrame Phish Landing Page M2 2026-01-05 |
rev 2 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.eminescusm .ro domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.edbtraining .com .au domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.2bd .net domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.eminescusm .ro domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.your .my .id domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.edbtraining .com .au domain |
rev 1 |
2026-01-12 |
| suricata |
ET ATTACK_RESPONSE 123Stealer Payload Inbound |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.jo3 .org domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.generaloweb .com domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.xn--72cg7bdd3bro6b3ab9c8btw4x .com domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.chem101 .com domain |
rev 1 |
2026-01-12 |
| suricata |
ET MALWARE GhostPenguin C2 Beacon Observed |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.2bd .net domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.chem101 .com domain |
rev 1 |
2026-01-12 |
| snort |
ET TROJAN DeskRAT Victim HeartBeat Response |
rev 1 |
2026-01-09 |
| snort |
ET ATTACK_RESPONSE GETA RAT Obfuscated Payload Inbound |
rev 1 |
2026-01-09 |
| snort |
ET TROJAN DeskRAT CnC Welcome Message |
rev 1 |
2026-01-09 |
| snort |
ET TROJAN DeskRAT CnC HeartBeat Request |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE DeskRAT CnC HeartBeat Request |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE DeskRAT CnC Welcome Message |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE DeskRAT Victim HeartBeat Response |
rev 1 |
2026-01-09 |
| suricata |
ET ATTACK_RESPONSE GETA RAT Obfuscated Payload Inbound |
rev 1 |
2026-01-09 |
| sigma |
Outlook Security Settings Updated - Registry |
test |
2026-01-09 |
| sigma |
Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location |
experimental |
2026-01-09 |
| sigma |
Suspicious Msiexec Execute Arbitrary DLL |
test |
2026-01-09 |
| sigma |
Potential Persistence Via Visual Studio Tools for Office |
test |
2026-01-09 |
| sigma |
System Language Discovery via Reg.Exe |
experimental |
2026-01-09 |
| sigma |
Inbox Rules Creation Or Update Activity in O365 |
experimental |
2026-01-09 |
| sigma |
HackTool - WSASS Execution |
experimental |
2026-01-09 |
| sigma |
Suspicious Creation TXT File in User Desktop |
test |
2026-01-09 |
| sigma |
WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze |
experimental |
2026-01-09 |
| sigma |
Office Macro File Creation |
test |
2026-01-09 |
| snort |
ET TROJAN MaskGramStealer CnC initial Victim Checkin |
rev 1 |
2026-01-08 |
| snort |
ET TROJAN WeyhroC2 Heartbeat |
rev 1 |
2026-01-08 |
| suricata |
ET MALWARE MaskGramStealer CnC initial Victim Checkin |
rev 1 |
2026-01-08 |
| suricata |
ET MALWARE WeyhroC2 Heartbeat |
rev 1 |
2026-01-08 |
| sigma |
Shell Invocation via Env Command - Linux |
test |
2026-01-08 |
| snort |
ET WEB_SPECIFIC_APPS VStarcam get_online_log.cgi Information Disclosure Attempt |
rev 1 |
2026-01-07 |
| suricata |
ET WEB_SPECIFIC_APPS VStarcam get_online_log.cgi Information Disclosure Attempt |
rev 1 |
2026-01-07 |