| sigma |
PPL Tampering Via WerFaultSecure |
experimental |
2025-11-23 |
| sigma |
Potential Tampering With RDP Related Registry Keys Via Reg.EXE |
test |
2025-11-22 |
| sigma |
RDP Sensitive Settings Changed |
test |
2025-11-22 |
| sigma |
Windows Default Domain GPO Modification via GPME |
experimental |
2025-11-22 |
| sigma |
Atomic MacOS Stealer - Persistence Indicators |
experimental |
2025-11-22 |
| sigma |
Atomic MacOS Stealer - FileGrabber Activity |
experimental |
2025-11-22 |
| sigma |
Potentially Suspicious Long Filename Pattern - Linux |
experimental |
2025-11-22 |
| sigma |
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection |
test |
2025-11-22 |
| sigma |
JexBoss Command Sequence |
test |
2025-11-22 |
| sigma |
Windows Default Domain GPO Modification |
experimental |
2025-11-22 |
| sigma |
Suspicious Filename with Embedded Base64 Commands |
experimental |
2025-11-22 |
| snort |
ET INFO Observed HTTP Content-Type Common to DoH Services |
rev 1 |
2025-11-21 |
| snort |
ET INFO Observed request to common DOH pattern in URI M1 |
rev 1 |
2025-11-21 |
| suricata |
ET INFO Observed HTTP Content-Type Common to DoH Services |
rev 1 |
2025-11-21 |
| suricata |
ET INFO Observed request to common DOH pattern in URI M1 |
rev 1 |
2025-11-21 |
| elastic |
Deprecated - AWS Root Login Without MFA |
deprecated |
2025-11-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| snort |
ET TROJAN OtterCookie File Exfiltration M2 |
rev 1 |
2025-11-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| snort |
ET INFO Observed DNS Query to .cfd TLD |
rev 1 |
2025-11-20 |
| suricata |
ET MALWARE OtterCookie File Exfiltration M2 |
rev 1 |
2025-11-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| suricata |
ET INFO Observed DNS Query to .cfd TLD |
rev 1 |
2025-11-20 |
| sigma |
Cisco ASA Exploitation Activity - Proxy |
experimental |
2025-11-20 |
| snort |
ET TROJAN WallStealer CnC Checkin - System Information |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN Arkanix Stealer CnC Response M1 |
rev 1 |
2025-11-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Response M3 |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Checkin - get_dll Request |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN Arkanix Stealer Data Exfiltration Attempt |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Checkin - Data Exfiltration |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN Arkanix Stealer CnC Checkin |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Response M2 |
rev 1 |
2025-11-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Response M1 |
rev 1 |
2025-11-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Checkin - System Information |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Response M2 |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Response M3 |
rev 1 |
2025-11-19 |