| sigma |
Suspicious Network Command |
test |
2025-10-19 |
| sigma |
Potential Devil Bait Malware Reconnaissance |
test |
2025-10-19 |
| sigma |
Potential Snatch Ransomware Activity |
stable |
2025-10-19 |
| sigma |
PFX File Creation |
test |
2025-10-19 |
| sigma |
Suspicious SYSTEM User Process Creation |
test |
2025-10-19 |
| sigma |
File Access Of Signal Desktop Sensitive Data |
experimental |
2025-10-19 |
| sigma |
Kerberoasting Activity - Initial Query |
test |
2025-10-19 |
| sigma |
BaaUpdate.exe Suspicious DLL Load |
experimental |
2025-10-18 |
| sigma |
Suspicious BitLocker Access Agent Update Utility Execution |
experimental |
2025-10-18 |
| sigma |
WannaCry Ransomware Activity |
test |
2025-10-18 |
| sigma |
Firewall Configuration Discovery Via Netsh.EXE |
test |
2025-10-18 |
| sigma |
GitHub Repository Archive Status Changed |
experimental |
2025-10-18 |
| sigma |
GitHub Repository Pages Site Changed to Public |
experimental |
2025-10-18 |
| sigma |
AWS KMS Imported Key Material Usage |
experimental |
2025-10-18 |
| sigma |
Kaspersky Endpoint Security Stopped Via CommandLine - Linux |
experimental |
2025-10-18 |
| sigma |
Suspicious Access to Sensitive File Extensions |
test |
2025-10-17 |
| sigma |
Account Tampering - Suspicious Failed Logon Reasons |
test |
2025-10-17 |
| sigma |
Suspicious Access to Sensitive File Extensions - Zeek |
test |
2025-10-17 |
| sigma |
Ping Hex IP |
test |
2025-10-17 |
| sigma |
Mask System Power Settings Via Systemctl |
experimental |
2025-10-17 |
| sigma |
Alternate PowerShell Hosts - PowerShell Module |
test |
2025-10-17 |
| sigma |
Potential Executable Run Itself As Sacrificial Process |
experimental |
2025-10-17 |
| sigma |
PUA - Restic Backup Tool Execution |
experimental |
2025-10-17 |
| sigma |
File With Uncommon Extension Created By An Office Application |
test |
2025-10-17 |
| sigma |
Audit Rules Deleted Via Auditctl |
experimental |
2025-10-17 |
| sigma |
SMB Create Remote File Admin Share |
test |
2025-10-17 |
| sigma |
Potentially Suspicious Desktop Background Change Via Registry |
test |
2025-10-17 |
| sigma |
Office Application Initiated Network Connection To Non-Local IP |
test |
2025-10-17 |
| sigma |
Python WebServer Execution - Linux |
experimental |
2025-10-17 |
| sigma |
Suspicious Userinit Child Process |
test |
2025-10-17 |
| sigma |
Office Application Initiated Network Connection Over Uncommon Ports |
test |
2025-10-17 |
| sigma |
Program Executed Using Proxy/Local Command Via SSH.EXE |
test |
2025-10-16 |
| sigma |
Syslog Clearing or Removal Via System Utilities |
test |
2025-10-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |