| snort |
ET INFO DYNAMIC_DNS Query to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| suricata |
ET EXPLOIT Chrome V8 Shellcode Inject Attempt |
rev 1 |
2025-10-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| snort |
ET TROJAN Amadey PowerShell Loader Inbound |
rev 1 |
2025-10-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| suricata |
ET MALWARE Amadey PowerShell Loader Inbound |
rev 1 |
2025-10-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| sigma |
Renamed Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| sigma |
Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| sigma |
MSDT Execution Via Answer File |
test |
2025-10-29 |
| sigma |
Suspicious CustomShellHost Execution |
test |
2025-10-29 |
| sigma |
Suspicious CertReq Command to Download |
experimental |
2025-10-29 |
| sigma |
Office Macro File Download |
test |
2025-10-29 |
| snort |
ET CURRENT_EVENTS Common Phish Redirect Chain - GCS to divists .us .com |
rev 1 |
2025-10-28 |
| snort |
ET CURRENT_EVENTS Landing Page Victim Registration Validation |
rev 1 |
2025-10-28 |
| suricata |
ET PHISHING Landing Page Victim Registration Validation |
rev 1 |
2025-10-28 |
| suricata |
ET PHISHING Common Phish Redirect Chain - GCS to divists .us .com |
rev 1 |
2025-10-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| snort |
ET TROJAN EtherHiding Exfil M1 |
rev 1 |
2025-10-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| snort |
ET CURRENT_EVENTS Observed UNK_SmudgedSerpent Style URI |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| suricata |
ET PHISHING Observed UNK_SmudgedSerpent Style URI |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| suricata |
ET MALWARE EtherHiding Exfil M1 |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| sigma |
File Download From Browser Process Via Inline URL |
test |
2025-10-27 |
| sigma |
Tor Client/Browser Execution |
test |
2025-10-27 |
| sigma |
Potential Persistence Via New AMSI Providers - Registry |
test |
2025-10-26 |
| sigma |
Potential Persistence Via Logon Scripts - Registry |
test |
2025-10-26 |
| sigma |
PUA - Sysinternal Tool Execution - Registry |
test |
2025-10-26 |
| sigma |
Potential COM Object Hijacking Via TreatAs Subkey - Registry |
test |
2025-10-26 |
| sigma |
PUA - Sysinternals Tools Execution - Registry |
test |
2025-10-26 |