| snort |
ET CURRENT_EVENTS Common Credential Theft Redirect Page |
rev 1 |
2025-11-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| suricata |
ET PHISHING Common Credential Theft Redirect Page |
rev 1 |
2025-11-26 |
| sigma |
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix |
experimental |
2025-11-26 |
| sigma |
Grixba Malware Reconnaissance Activity |
experimental |
2025-11-26 |
| snort |
ET TROJAN WallStealer Data Exfiltration Attempt over Telegram |
rev 1 |
2025-11-25 |
| snort |
ET CURRENT_EVENTS RondoDox BotNet Init Script Inbound |
rev 1 |
2025-11-25 |
| snort |
ET CURRENT_EVENTS Mirai Variant Payload Inbound |
rev 1 |
2025-11-25 |
| snort |
ET WEB_SPECIFIC_APPS N-able N-central Session ID Disclosure |
rev 1 |
2025-11-25 |
| suricata |
ET EXPLOIT_KIT RondoDox BotNet Init Script Inbound |
rev 1 |
2025-11-25 |
| suricata |
ET MALWARE WallStealer Data Exfiltration Attempt over Telegram |
rev 1 |
2025-11-25 |
| suricata |
ET WEB_SPECIFIC_APPS N-able N-central Session ID Disclosure |
rev 1 |
2025-11-25 |
| suricata |
ET EXPLOIT_KIT Mirai Variant Payload Inbound |
rev 1 |
2025-11-25 |
| sigma |
Suspicious File Created by ArcSOC.exe |
experimental |
2025-11-25 |
| sigma |
Script Interpreter Spawning Credential Scanner - Windows |
experimental |
2025-11-25 |
| sigma |
Script Interpreter Spawning Credential Scanner - Linux |
experimental |
2025-11-25 |
| sigma |
Suspicious ArcSOC.exe Child Process |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malicious Bun Execution - Linux |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malicious Bun Execution |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malware Indicators - Linux |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malware Indicators - Windows |
experimental |
2025-11-25 |
| snort |
ET INFO POST Request to .cfd Domain |
rev 1 |
2025-11-24 |
| suricata |
ET HUNTING POST Request to .cfd Domain |
rev 1 |
2025-11-24 |
| sigma |
Potential Container Discovery Via Inodes Listing |
test |
2025-11-24 |
| sigma |
Suspicious FileFix Execution Pattern |
experimental |
2025-11-24 |
| sigma |
PPL Tampering Via WerFaultSecure |
experimental |
2025-11-23 |
| sigma |
Potential Tampering With RDP Related Registry Keys Via Reg.EXE |
test |
2025-11-22 |
| sigma |
RDP Sensitive Settings Changed |
test |
2025-11-22 |
| sigma |
Windows Default Domain GPO Modification |
experimental |
2025-11-22 |
| sigma |
JexBoss Command Sequence |
test |
2025-11-22 |
| sigma |
Windows Default Domain GPO Modification via GPME |
experimental |
2025-11-22 |
| sigma |
Suspicious Filename with Embedded Base64 Commands |
experimental |
2025-11-22 |
| sigma |
Atomic MacOS Stealer - Persistence Indicators |
experimental |
2025-11-22 |
| sigma |
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection |
test |
2025-11-22 |
| sigma |
Atomic MacOS Stealer - FileGrabber Activity |
experimental |
2025-11-22 |
| sigma |
Potentially Suspicious Long Filename Pattern - Linux |
experimental |
2025-11-22 |
| snort |
ET INFO Observed HTTP Content-Type Common to DoH Services |
rev 1 |
2025-11-21 |