| sigma |
Uncommon PowerShell Hosts |
test |
2025-10-22 |
| sigma |
Use Short Name Path in Command Line |
test |
2025-10-22 |
| sigma |
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification |
test |
2025-10-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| sigma |
Blackbyte Ransomware Registry |
test |
2025-10-21 |
| sigma |
HackTool - Windows Credential Editor (WCE) Execution |
test |
2025-10-21 |
| sigma |
Potentially Suspicious JWT Token Search Via CLI |
test |
2025-10-21 |
| sigma |
PUA - AWS TruffleHog Execution |
experimental |
2025-10-21 |
| sigma |
AWS Successful Console Login Without MFA |
experimental |
2025-10-21 |
| snort |
ET TROJAN GlassWorm Decryption IV/Key Response |
rev 1 |
2025-10-20 |
| suricata |
ET MALWARE GlassWorm Decryption IV/Key Response |
rev 1 |
2025-10-20 |
| sigma |
Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790) |
experimental |
2025-10-20 |
| sigma |
Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791) |
experimental |
2025-10-20 |
| sigma |
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788) |
experimental |
2025-10-20 |
| sigma |
Usage Of Web Request Commands And Cmdlets |
test |
2025-10-20 |
| sigma |
Usage Of Web Request Commands And Cmdlets - ScriptBlock |
test |
2025-10-20 |
| sigma |
Local Accounts Discovery |
test |
2025-10-20 |
| sigma |
Use Short Name Path in Image |
test |
2025-10-20 |
| sigma |
PowerShell Download Pattern |
test |
2025-10-20 |
| sigma |
System Disk And Volume Reconnaissance Via Wmic.EXE |
test |
2025-10-20 |
| sigma |
Suspicious File Write to Webapps Root Directory |
experimental |
2025-10-20 |
| sigma |
Turla Group Commands May 2020 |
test |
2025-10-19 |
| sigma |
Potential Data Exfiltration Activity Via CommandLine Tools |
test |
2025-10-19 |
| sigma |
Potential Devil Bait Malware Reconnaissance |
test |
2025-10-19 |
| sigma |
Suspicious Network Command |
test |
2025-10-19 |
| sigma |
Potential Snatch Ransomware Activity |
stable |
2025-10-19 |
| sigma |
Potential LSASS Process Dump Via Procdump |
stable |
2025-10-19 |
| sigma |
Mint Sandstorm - AsperaFaspex Suspicious Process Execution |
test |
2025-10-19 |
| sigma |
Mint Sandstorm - ManageEngine Suspicious Process Execution |
test |
2025-10-19 |
| sigma |
Powershell Token Obfuscation - Powershell |
test |
2025-10-19 |
| sigma |
PFX File Creation |
test |
2025-10-19 |
| sigma |
ISATAP Router Address Was Set |
experimental |
2025-10-19 |
| sigma |
Suspicious SYSTEM User Process Creation |
test |
2025-10-19 |