| sigma |
Attempts of Kerberos Coercion Via DNS SPN Spoofing |
experimental |
2025-06-20 |
| sigma |
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network |
experimental |
2025-06-20 |
| sigma |
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation |
experimental |
2025-06-20 |
| snort |
ET TROJAN Adaptix C2 Default User-Agent Observed |
rev 1 |
2025-06-18 |
| snort |
ET TROJAN Adaptix C2 X-Beacon-Id HTTP Header Observed |
rev 1 |
2025-06-18 |
| suricata |
ET MALWARE Adaptix C2 Default User-Agent Observed |
rev 1 |
2025-06-18 |
| suricata |
ET MALWARE Adaptix C2 X-Beacon-Id HTTP Header Observed |
rev 1 |
2025-06-18 |
| snort |
ET TROJAN Observed TA4557 More_eggs Fake Resume Page |
rev 1 |
2025-06-17 |
| suricata |
ET MALWARE Observed TA4557 More_eggs Fake Resume Page |
rev 1 |
2025-06-17 |
| sigma |
Trusted Path Bypass via Windows Directory Spoofing |
experimental |
2025-06-17 |
| sigma |
TrustedPath UAC Bypass Pattern |
test |
2025-06-17 |
| sigma |
Suspicious Download and Execute Pattern via Curl/Wget |
experimental |
2025-06-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.jakegub .com domain |
rev 1 |
2025-06-16 |
| snort |
ET INFO Dotted Quad Host Base64-Encoded PHP payload |
rev 1 |
2025-06-16 |
| snort |
ET INFO Dotted Quad Host Workzueg HTTP Server String Response |
rev 1 |
2025-06-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.jakegub .com domain |
rev 1 |
2025-06-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.medialoverz .com domain |
rev 1 |
2025-06-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.medialoverz .com domain |
rev 1 |
2025-06-16 |
| snort |
ET INFO Dotted Quad Host Base64-Encoded Powershell Payload |
rev 1 |
2025-06-16 |
| suricata |
ET HUNTING Dotted Quad Host Base64-Encoded PHP payload |
rev 1 |
2025-06-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.jakegub .com domain |
rev 1 |
2025-06-16 |
| suricata |
ET HUNTING Dotted Quad Host Workzueg HTTP Server String Response |
rev 1 |
2025-06-16 |
| suricata |
ET HUNTING Dotted Quad Host Base64-Encoded Powershell Payload |
rev 1 |
2025-06-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.medialoverz .com domain |
rev 1 |
2025-06-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.medialoverz .com domain |
rev 1 |
2025-06-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.jakegub .com domain |
rev 1 |
2025-06-16 |
| sigma |
Hidden Files and Directories |
test |
2025-06-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.c-om .net domain |
rev 1 |
2025-06-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.c-om .net domain |
rev 1 |
2025-06-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.c-om .net domain |
rev 1 |
2025-06-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.c-om .net domain |
rev 1 |
2025-06-15 |
| sigma |
Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load |
experimental |
2025-06-13 |
| sigma |
Potential Exploitation of RCE Vulnerability CVE-2025-33053 |
experimental |
2025-06-13 |
| sigma |
Process Execution From WebDAV Share |
experimental |
2025-06-13 |
| sigma |
Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access |
experimental |
2025-06-13 |
| snort |
ET TROJAN GorillaBot CnC Server Probe |
rev 1 |
2025-06-11 |
| snort |
ET INFO HTTP Response Containing Base64-Encoded Powershell Payload Keywords |
rev 1 |
2025-06-11 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.maganaki .com domain |
rev 1 |
2025-06-11 |
| snort |
ET INFO HTTP Response Containing Base64-Encoded and Compressed Powershell Payload Keywords |
rev 1 |
2025-06-11 |
| snort |
ET TROJAN GorillaBot Victim BotID Sent to CnC Server |
rev 1 |
2025-06-11 |