| sigma |
COM Object Hijacking Via Modification Of Default System CLSID Default Value |
experimental |
2025-11-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| snort |
ET TROJAN LeakyStealer CnC Checkin |
rev 1 |
2025-11-07 |
| suricata |
ET MALWARE LeakyStealer CnC Checkin |
rev 1 |
2025-11-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| snort |
ET TROJAN Observed VBScript Payload Downloader Inbound |
rev 1 |
2025-11-04 |
| snort |
ET TROJAN MEOWBACKCONN CnC Checkin - Server Response |
rev 1 |
2025-11-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| suricata |
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response |
rev 1 |
2025-11-04 |
| suricata |
ET MALWARE Observed VBScript Payload Downloader Inbound |
rev 1 |
2025-11-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| sigma |
Suspicious Space Characters in TypedPaths Registry Path - FileFix |
experimental |
2025-11-04 |
| sigma |
Suspicious Space Characters in RunMRU Registry Path - ClickFix |
experimental |
2025-11-04 |
| sigma |
Windows MSIX Package Support Framework AI_STUBS Execution |
experimental |
2025-11-03 |
| sigma |
Successful MSIX/AppX Package Installation |
experimental |
2025-11-03 |
| sigma |
Possible PrintNightmare Print Driver Install - CVE-2021-1675 |
stable |
2025-11-03 |
| sigma |
Potential NetWire RAT Activity - Registry |
test |
2025-11-03 |
| sigma |
Windows AppX Deployment Full Trust Package Installation |
experimental |
2025-11-03 |
| sigma |
Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800 |
test |
2025-11-03 |
| sigma |
Potential Dtrack RAT Activity |
stable |
2025-11-03 |
| sigma |
OMIGOD HTTP No Authentication RCE - CVE-2021-38647 |
stable |
2025-11-03 |
| sigma |
Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE |
test |
2025-11-03 |
| sigma |
Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966 |
test |
2025-11-03 |
| sigma |
Windows AppX Deployment Unsigned Package Installation |
experimental |
2025-11-03 |
| sigma |
FortiGate - New VPN SSL Web Portal Added |
experimental |
2025-11-01 |
| sigma |
FortiGate - New Local User Created |
experimental |
2025-11-01 |
| sigma |
FortiGate - VPN SSL Settings Modified |
experimental |
2025-11-01 |
| sigma |
FortiGate - User Group Modified |
experimental |
2025-11-01 |
| sigma |
FortiGate - New Administrator Account Created |
experimental |
2025-11-01 |
| sigma |
Explorer Process Tree Break |
test |
2025-10-31 |
| sigma |
Wlrmdr.EXE Uncommon Argument Or Child Process |
experimental |
2025-10-31 |
| sigma |
Creation of a Local Hidden User Account by Registry |
test |
2025-10-31 |
| sigma |
Capture Credentials with Rpcping.exe |
test |
2025-10-31 |
| sigma |
Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process |
experimental |
2025-10-31 |
| sigma |
Exploitation Activity of CVE-2025-59287 - WSUS Deserialization |
experimental |
2025-10-31 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |