| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| sigma |
Potential Hello-World Scraper Botnet Activity |
experimental |
2025-08-02 |
| snort |
ET TROJAN Storm-2603 AK47C2 HTTP Backdoor CnC Checkin |
rev 1 |
2025-08-01 |
| suricata |
ET MALWARE Storm-2603 AK47C2 HTTP Backdoor CnC Checkin |
rev 1 |
2025-08-01 |
| sigma |
Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) |
experimental |
2025-08-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| snort |
ET TROJAN Observed Kimsuky Domain in TLS SNI |
rev 1 |
2025-07-31 |
| snort |
ET TROJAN Kimsuky CnC AppKey Request |
rev 1 |
2025-07-31 |
| snort |
ET TROJAN Kimsuky CnC AppKey Deletion Request |
rev 1 |
2025-07-31 |
| snort |
ET TROJAN Kimsuky CnC Domain in DNS Lookup |
rev 1 |
2025-07-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Kimsuky CnC AppKey Request |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Observed Kimsuky Domain in TLS SNI |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Kimsuky CnC Domain in DNS Lookup |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Kimsuky CnC AppKey Deletion Request |
rev 1 |
2025-07-31 |
| sigma |
Windows Recovery Environment Disabled Via Reagentc |
experimental |
2025-07-31 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| sigma |
Password Set to Never Expire via WMI |
experimental |
2025-07-30 |
| sigma |
Process Initiated Network Connection To Ngrok Domain |
test |
2025-07-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| sigma |
Virtualbox Driver Installation or Starting of VMs |
test |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.118iranian .com domain |
rev 1 |
2025-07-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.118iranian .com domain |
rev 1 |
2025-07-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.118iranian .com domain |
rev 1 |
2025-07-26 |