| sigma |
Removal Of Index Value to Hide Schedule Task - Registry |
test |
2025-10-25 |
| sigma |
Cred Dump Tools Dropped Files |
test |
2025-10-25 |
| sigma |
Removal Of SD Value to Hide Schedule Task - Registry |
test |
2025-10-25 |
| sigma |
System Information Discovery via Registry Queries |
experimental |
2025-10-25 |
| snort |
ET TROJAN Valkyrie Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-10-24 |
| snort |
ET TROJAN Valkyrie Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-10-24 |
| snort |
ET TROJAN Shark Stealer CnC Checkin |
rev 1 |
2025-10-24 |
| suricata |
ET MALWARE Valkyrie Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-10-24 |
| suricata |
ET MALWARE Valkyrie Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-10-24 |
| suricata |
ET MALWARE Shark Stealer CnC Checkin |
rev 1 |
2025-10-24 |
| sigma |
PUA - AdFind Suspicious Execution |
test |
2025-10-24 |
| snort |
ET CURRENT_EVENTS TyKit CnC Request M1 2025-10-23 |
rev 1 |
2025-10-23 |
| snort |
ET CURRENT_EVENTS TyKit CnC Request M2 2025-10-23 |
rev 1 |
2025-10-23 |
| snort |
ET CURRENT_EVENTS TyKit Exfil M2 2025-10-23 |
rev 1 |
2025-10-23 |
| snort |
ET TROJAN Phantom Captcha Fake Chrome User-Agent Observed |
rev 1 |
2025-10-23 |
| snort |
ET CURRENT_EVENTS TyKit Exfil M1 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit CnC Request M2 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET MALWARE Phantom Captcha Fake Chrome User-Agent Observed |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit CnC Request M1 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit Exfil M2 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit Exfil M1 2025-10-23 |
rev 1 |
2025-10-23 |
| sigma |
WFP Filter Added via Registry |
experimental |
2025-10-23 |
| sigma |
Suspicious Speech Runtime Binary Child Process |
experimental |
2025-10-23 |
| sigma |
Classes Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
CurrentVersion Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Potential Lateral Movement via Windows Remote Shell |
experimental |
2025-10-22 |
| sigma |
CurrentVersion NT Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Winrs Local Command Execution |
experimental |
2025-10-22 |
| sigma |
Scheduled TaskCache Change by Uncommon Program |
test |
2025-10-22 |
| sigma |
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Potential Ursnif Malware Activity - Registry |
test |
2025-10-22 |
| sigma |
Suspicious Non PowerShell WSMAN COM Provider |
test |
2025-10-22 |
| sigma |
Registry Persistence via Service in Safe Mode |
test |
2025-10-22 |
| sigma |
Common Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Uncommon PowerShell Hosts |
test |
2025-10-22 |
| sigma |
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE |
test |
2025-10-22 |
| sigma |
Scheduled Task Creation Via Schtasks.EXE |
test |
2025-10-22 |
| sigma |
WMIC Remote Command Execution |
test |
2025-10-22 |
| sigma |
Potential Persistence Via Shim Database Modification |
test |
2025-10-22 |
| sigma |
Sysmon Channel Reference Deletion |
test |
2025-10-22 |