| sigma |
Transferring Files with Credential Data via Network Shares |
test |
2025-07-11 |
| sigma |
PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' |
experimental |
2025-07-11 |
| sigma |
Windows Defender Threat Severity Default Action Modified |
experimental |
2025-07-11 |
| sigma |
COM Hijacking via TreatAs |
test |
2025-07-11 |
| sigma |
Suspicious Volume Shadow Copy VSS_PS.dll Load |
test |
2025-07-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.casiomexico .com .mx domain |
rev 1 |
2025-07-10 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| snort |
ET TROJAN Agent Tesla CnC Exfil via TCP |
rev 1 |
2025-07-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.casiomexico .com .mx domain |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| suricata |
ET MALWARE Agent Tesla CnC Exfil via TCP |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.casiomexico .com .mx domain |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.casiomexico .com .mx domain |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| suricata |
ET INFO Invalid GTP Response Packet Observed |
rev 1 |
2025-07-09 |
| suricata |
ET EXPLOIT GTPDoor Trigger Packet Request |
rev 1 |
2025-07-09 |
| suricata |
ET EXPLOIT GTPDoor Trigger Packet Response |
rev 1 |
2025-07-09 |
| elastic |
Deprecated - Azure Virtual Network Device Modified or Deleted |
deprecated |
2025-07-09 |
| sigma |
Suspicious Active Directory Database Snapshot Via ADExplorer |
test |
2025-07-09 |
| sigma |
Disabling Windows Defender WMI Autologger Session via Reg.exe |
experimental |
2025-07-09 |
| sigma |
Active Directory Database Snapshot Via ADExplorer |
test |
2025-07-09 |
| sigma |
ADExplorer Writing Complete AD Snapshot Into .dat File |
experimental |
2025-07-09 |
| sigma |
Windows Defender Context Menu Removed |
experimental |
2025-07-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| snort |
ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit Attempt |
rev 2 |
2025-07-08 |
| snort |
ET TROJAN NordDragonScan CnC Checkin |
rev 1 |
2025-07-08 |
| snort |
ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE |
rev 4 |
2025-07-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| snort |
ET TROJAN NordDragonScan Data Exfiltration Attempt |
rev 1 |
2025-07-08 |
| suricata |
ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit Attempt |
rev 7 |
2025-07-08 |
| suricata |
ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE |
rev 9 |
2025-07-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| suricata |
ET MALWARE NordDragonScan Data Exfiltration Attempt |
rev 1 |
2025-07-08 |
| suricata |
ET MALWARE NordDragonScan CnC Checkin |
rev 1 |
2025-07-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| sigma |
Remote Thread Creation By Uncommon Source Image |
test |
2025-07-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.tvphone .com domain |
rev 1 |
2025-07-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.tvphone .com domain |
rev 1 |
2025-07-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.tvphone .com domain |
rev 1 |
2025-07-07 |