| sigma |
Potential DLL Sideloading Of DBGHELP.DLL |
test |
2025-10-07 |
| sigma |
Potential Goopdate.DLL Sideloading |
test |
2025-10-07 |
| sigma |
Change PowerShell Policies to an Insecure Level |
test |
2025-10-07 |
| sigma |
Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE |
test |
2025-10-07 |
| sigma |
Potential Exploitation of GoAnywhere MFT Vulnerability |
experimental |
2025-10-07 |
| sigma |
Amsi.DLL Loaded Via LOLBIN Process |
test |
2025-10-07 |
| sigma |
Delete Defender Scan ShellEx Context Menu Registry Key |
experimental |
2025-10-07 |
| sigma |
Powershell Create Scheduled Task |
test |
2025-10-07 |
| sigma |
Verclsid.exe Runs COM Object |
test |
2025-10-07 |
| sigma |
Potential Antivirus Software DLL Sideloading |
test |
2025-10-07 |
| sigma |
Potential PendingFileRenameOperations Tampering |
test |
2025-10-07 |
| sigma |
Removal Of AMSI Provider Registry Keys |
test |
2025-10-07 |
| sigma |
Service Binary in Suspicious Folder |
test |
2025-10-07 |
| sigma |
Removal of Potential COM Hijacking Registry Keys |
test |
2025-10-07 |
| sigma |
PowerShell Module File Created By Non-PowerShell Process |
test |
2025-10-07 |
| sigma |
Firewall Rule Deleted Via Netsh.EXE |
test |
2025-10-07 |
| sigma |
Unsigned DLL Loaded by Windows Utility |
test |
2025-10-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| sigma |
Potential DLL Sideloading Of DBGCORE.DLL |
test |
2025-10-06 |
| sigma |
Potential JLI.dll Side-Loading |
experimental |
2025-10-06 |
| sigma |
Suspicious Eventlog Clear |
test |
2025-10-06 |
| sigma |
New RUN Key Pointing to Suspicious Folder |
experimental |
2025-10-06 |
| snort |
ET TROJAN Oyster Backdoor CnC Checkin M6 |
rev 1 |
2025-10-03 |
| snort |
ET TROJAN Oyster Backdoor CnC Checkin M5 |
rev 1 |
2025-10-03 |
| suricata |
ET MALWARE Oyster Backdoor CnC Checkin M6 |
rev 1 |
2025-10-03 |
| suricata |
ET MALWARE Oyster Backdoor CnC Checkin M5 |
rev 1 |
2025-10-03 |
| snort |
ET ATTACK_RESPONSE Braodo Loader Inbound |
rev 1 |
2025-10-02 |
| suricata |
ET ATTACK_RESPONSE Braodo Loader Inbound |
rev 1 |
2025-10-02 |
| sigma |
Linux Sudo Chroot Execution |
experimental |
2025-10-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mukeshbasnet .com .np domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mukeshbasnet .com .np domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.einfach-du .ch domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.maderasrm .cl domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.maderasrm .cl domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.einfach-du .ch domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.giripawan .com .np domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.giripawan .com .np domain |
rev 1 |
2025-10-01 |