| snort |
ET TROJAN Synapse/Lambda Ransomware CnC Checkin |
rev 2 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.giftofappetite .com domain |
rev 1 |
2025-08-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.giftofappetite .com domain |
rev 1 |
2025-08-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.giftofappetite .com domain |
rev 1 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| sigma |
FunkLocker Ransomware File Creation |
experimental |
2025-08-08 |
| snort |
ET TROJAN TinyLoader CnC Response M2 |
rev 1 |
2025-08-07 |
| snort |
ET TROJAN TinyLoader CnC Response M1 |
rev 1 |
2025-08-07 |
| suricata |
ET MALWARE TinyLoader CnC Response M1 |
rev 1 |
2025-08-07 |
| suricata |
ET MALWARE TinyLoader CnC Response M2 |
rev 1 |
2025-08-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Webpage Inbound |
rev 1 |
2025-08-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Webpage Inbound |
rev 1 |
2025-08-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| suricata |
ET WEB_SPECIFIC_APPS ABB Cylon Aspect Guest login Privilege Escalation M2 |
rev 1 |
2025-08-05 |
| suricata |
ET WEB_SPECIFIC_APPS ABB Cylon Aspect Guest login Privilege Escalation M1 |
rev 1 |
2025-08-05 |
| sigma |
Potentially Suspicious Execution From Tmp Folder |
test |
2025-08-05 |
| snort |
ET WEB_SPECIFIC_APPS Ilevia EVE X1 Server dbcheck.php db_log parameter Pre-Auth File Disclosure Attempt |
rev 1 |
2025-08-04 |
| suricata |
ET WEB_SPECIFIC_APPS Ilevia EVE X1 Server dbcheck.php db_log parameter Pre-Auth File Disclosure Attempt |
rev 1 |
2025-08-04 |
| sigma |
Low Reputation Effective Top-Level Domain (eTLD) |
experimental |
2025-08-04 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.clandestina .org domain |
rev 1 |
2025-08-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.clandestina .org domain |
rev 1 |
2025-08-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.clandestina .org domain |
rev 1 |
2025-08-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.clandestina .org domain |
rev 1 |
2025-08-02 |