| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.nigelupchurch .com domain |
rev 1 |
2025-06-28 |
| suricata |
ET MALWARE zgRAT / PureLogs CnC Server Connection M3 |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN zgRAT / PureLogs CnC Server Connection M3 |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN TA829 Requesting Next Stage |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN TA829 CnC Check-in - GAGA1 Variant |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN TA829 CnC Check-in - CMPN1 Variant |
rev 1 |
2025-06-27 |
| suricata |
ET MALWARE TA829 Requesting Next Stage |
rev 1 |
2025-06-27 |
| suricata |
ET MALWARE TA829 CnC Check-in - GAGA1 Variant |
rev 1 |
2025-06-27 |
| suricata |
ET MALWARE TA829 CnC Check-in - CMPN1 Variant |
rev 1 |
2025-06-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| snort |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| snort |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| suricata |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| suricata |
ET EXPLOIT SSH Client Key Exchange Init Cookie Null |
rev 3 |
2025-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| suricata |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| sigma |
Potential Notepad++ CVE-2025-49144 Exploitation |
experimental |
2025-06-26 |
| snort |
ET INFO Observed Usage of Non-Alphanumeric Javascript Obfuscation M1 |
rev 4 |
2025-06-25 |
| suricata |
ET HUNTING Observed Usage of Non-Alphanumeric Javascript Obfuscation M1 |
rev 4 |
2025-06-25 |
| snort |
ET TROJAN KimJongRAT CnC Checkin |
rev 1 |
2025-06-24 |
| snort |
ET TROJAN KimJongRAT Data Exfiltration Attempt |
rev 1 |
2025-06-24 |
| suricata |
ET MALWARE KimJongRAT CnC Checkin |
rev 1 |
2025-06-24 |
| suricata |
ET MALWARE KimJongRAT Data Exfiltration Attempt |
rev 1 |
2025-06-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| suricata |
ET MALWARE Diamotrix POST Request M3 |
rev 1 |
2025-06-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| sigma |
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation |
experimental |
2025-06-20 |