| suricata |
ET MALWARE Arkanix Stealer Data Exfiltration Attempt |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE Arkanix Stealer CnC Checkin |
rev 1 |
2025-11-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Response M2 |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE Arkanix Stealer CnC Response M1 |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Checkin - Data Exfiltration |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Checkin - System Information |
rev 1 |
2025-11-19 |
| sigma |
Suspicious ClickFix/FileFix Execution Pattern |
experimental |
2025-11-19 |
| sigma |
Potential ClickFix Execution Pattern - Registry |
experimental |
2025-11-19 |
| sigma |
DNS Query by Finger Utility |
experimental |
2025-11-19 |
| sigma |
Network Connection Initiated via Finger.EXE |
experimental |
2025-11-19 |
| sigma |
FileFix - Command Evidence in TypedPaths |
experimental |
2025-11-19 |
| snort |
ET TROJAN SilentSync-RAT CnC Tasking response |
rev 1 |
2025-11-18 |
| snort |
ET TROJAN SilentSync-RAT CnC file tasking request |
rev 1 |
2025-11-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| snort |
ET TROJAN SilentSync-RAT CNC Checkin |
rev 1 |
2025-11-18 |
| snort |
ET TROJAN SilentSync-RAT Tasking request |
rev 1 |
2025-11-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| suricata |
ET MALWARE SilentSync-RAT CnC Tasking response |
rev 1 |
2025-11-18 |
| suricata |
ET MALWARE SilentSync-RAT Tasking request |
rev 1 |
2025-11-18 |
| suricata |
ET MALWARE SilentSync-RAT CnC file tasking request |
rev 1 |
2025-11-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| suricata |
ET MALWARE SilentSync-RAT CNC Checkin |
rev 1 |
2025-11-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| sigma |
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class |
experimental |
2025-11-15 |
| sigma |
Potentially Suspicious NTFS Symlink Behavior Modification |
test |
2025-11-13 |
| snort |
ET TROJAN TA398 CurlBack_RAT CnC Activity - Fetch Commands M2 |
rev 2 |
2025-11-12 |
| snort |
ET TROJAN TA398 CurlBack_RAT CnC Activity - Upload Results |
rev 2 |
2025-11-12 |
| suricata |
ET PHISHING Roblox Phish Redirect 2025-11-12 |
rev 1 |
2025-11-12 |
| suricata |
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results |
rev 2 |
2025-11-12 |
| suricata |
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2 |
rev 2 |
2025-11-12 |
| sigma |
Suspicious Usage of For Loop with Recursive Directory Search in CMD |
experimental |
2025-11-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |