| suricata |
ET ATTACK_RESPONSE JScriptToPowerShell Obfuscator Payload Inbound |
rev 1 |
2025-12-26 |
| sigma |
Windows Credential Guard Disabled - Registry |
experimental |
2025-12-26 |
| sigma |
Windows Credential Guard Related Registry Value Deleted - Registry |
experimental |
2025-12-26 |
| sigma |
Windows Credential Guard Registry Tampering Via CommandLine |
experimental |
2025-12-26 |
| sigma |
Potential AutoLogger Sessions Tampering |
test |
2025-12-26 |
| sigma |
AMSI Disabled via Registry Modification |
experimental |
2025-12-25 |
| sigma |
Windows AMSI Related Registry Tampering Via CommandLine |
experimental |
2025-12-25 |
| sigma |
Windows EventLog Autologger Session Registry Modification Via CommandLine |
experimental |
2025-12-25 |
| snort |
ET TROJAN GachiLoader Staging HTTP Request |
rev 1 |
2025-12-23 |
| suricata |
ET MALWARE GachiLoader Staging HTTP Request |
rev 1 |
2025-12-23 |
| snort |
ET TROJAN Win.Supper Tunnel C2 Magic Bytes Detected |
rev 1 |
2025-12-22 |
| suricata |
ET MALWARE Win.Supper Tunnel C2 Magic Bytes Detected |
rev 1 |
2025-12-22 |
| snort |
ET TROJAN Possible CastleRAT Python Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M2 |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M3 |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT Python Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M2 |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M3 |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M6 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M2 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M8 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M5 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M9 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN ZeitLoader Payload Retrieval attempt |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M4 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M3 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M7 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE ZeitLoader Payload Retrieval attempt |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M2 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M9 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M6 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M7 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M5 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M4 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M8 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M3 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleLoader Malware Inbound Command Retrieval via Finger Service |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN CastleLoader Malware Stager Outbound Payload Request |
rev 1 |
2025-12-17 |