| sigma |
Potential PsExec Remote Execution |
test |
2025-09-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.jandjley .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.jandjley .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.jandjley .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.jandjley .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| sigma |
Suspicious Velociraptor Child Process |
experimental |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| sigma |
RestrictedAdminMode Registry Value Tampering - ProcCreation |
test |
2025-08-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| snort |
ET INFO GitHub Authentication via client_id in HTTP POST |
rev 1 |
2025-08-27 |
| snort |
ET TROJAN Possible OwlProxy activity M1 |
rev 2 |
2025-08-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| suricata |
ET MALWARE Possible OwlProxy activity M1 |
rev 2 |
2025-08-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| suricata |
ET HUNTING GitHub Authentication via client_id in HTTP POST |
rev 1 |
2025-08-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| sigma |
Regsvr32 DLL Execution With Suspicious File Extension |
test |
2025-08-27 |
| sigma |
Suspicious Windows Service Tampering |
test |
2025-08-27 |
| snort |
ET WEB_SPECIFIC_APPS VTENext Session Cookie Information Disclosure via Touch Module |
rev 1 |
2025-08-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.kalinnikova .com domain |
rev 1 |
2025-08-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.miguelrsilva .com domain |
rev 1 |
2025-08-26 |