| snort |
ET INFO DYNAMIC_DNS Query to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| sigma |
Potential CVE-2023-23397 Exploitation Attempt - SMB |
test |
2025-10-13 |
| sigma |
FTP Connection Open Attempt Via Winscp CLI |
experimental |
2025-10-12 |
| sigma |
Winscp Execution From Non Standard Folder |
experimental |
2025-10-12 |
| sigma |
AWS STS GetCallerIdentity Enumeration Via TruffleHog |
experimental |
2025-10-12 |
| sigma |
Modify System Firewall |
test |
2025-10-12 |
| sigma |
Suspicious Startup Folder Persistence |
test |
2025-10-12 |
| sigma |
WSL Kali-Linux Usage |
experimental |
2025-10-10 |
| sigma |
Installation of WSL Kali-Linux |
experimental |
2025-10-10 |
| snort |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2 |
rev 1 |
2025-10-08 |
| snort |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1 |
rev 1 |
2025-10-08 |
| snort |
ET TROJAN FrigidBackdoor Checkin |
rev 2 |
2025-10-08 |
| suricata |
ET MALWARE FrigidBackdoor Checkin |
rev 2 |
2025-10-08 |
| suricata |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2 |
rev 1 |
2025-10-08 |
| suricata |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1 |
rev 1 |
2025-10-08 |
| sigma |
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE |
test |
2025-10-08 |
| sigma |
Recon Command Output Piped To Findstr.EXE |
test |
2025-10-08 |
| sigma |
Potential Persistence Via Netsh Helper DLL - Registry |
test |
2025-10-08 |
| sigma |
Process Creation Using Sysnative Folder |
test |
2025-10-08 |
| sigma |
PowerShell Deleted Mounted Share |
test |
2025-10-07 |
| sigma |
Potential PendingFileRenameOperations Tampering |
test |
2025-10-07 |
| sigma |
New Kernel Driver Via SC.EXE |
test |
2025-10-07 |
| sigma |
Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE |
test |
2025-10-07 |
| sigma |
Potential Suspicious Browser Launch From Document Reader Process |
test |
2025-10-07 |
| sigma |
Potentially Suspicious Windows App Activity |
test |
2025-10-07 |
| sigma |
Potential Exploitation of GoAnywhere MFT Vulnerability |
experimental |
2025-10-07 |
| sigma |
Verclsid.exe Runs COM Object |
test |
2025-10-07 |
| sigma |
Delete Defender Scan ShellEx Context Menu Registry Key |
experimental |
2025-10-07 |
| sigma |
Process Proxy Execution Via Squirrel.EXE |
test |
2025-10-07 |
| sigma |
Service Binary in Suspicious Folder |
test |
2025-10-07 |
| sigma |
Firewall Rule Deleted Via Netsh.EXE |
test |
2025-10-07 |
| sigma |
Internet Explorer DisableFirstRunCustomize Enabled |
test |
2025-10-07 |