| sigma |
MSSQL Destructive Query |
experimental |
2025-06-04 |
| sigma |
File Decoded From Base64/Hex Via Certutil.EXE |
test |
2025-06-04 |
| sigma |
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE |
test |
2025-06-04 |
| sigma |
Disable Internal Tools or Feature in Registry |
test |
2025-06-04 |
| sigma |
RegAsm.EXE Execution Without CommandLine Flags or Files |
experimental |
2025-06-04 |
| sigma |
Access of Sudoers File Content |
test |
2025-06-04 |
| snort |
ET INFO Observed UA-Disp Header |
rev 1 |
2025-06-03 |
| snort |
ET INFO Observed UA-CPU Header |
rev 1 |
2025-06-03 |
| snort |
ET INFO Observed UA-Color Header |
rev 1 |
2025-06-03 |
| snort |
ET TROJAN JanelaRAT Delivery Script Retrieving .MSI |
rev 1 |
2025-06-03 |
| snort |
ET TROJAN JanelaRAT CnC Checkin Observed |
rev 4 |
2025-06-03 |
| snort |
ET TROJAN JanelaRAT Staging URL |
rev 1 |
2025-06-03 |
| snort |
ET INFO Observed UA-Pixels Header |
rev 1 |
2025-06-03 |
| snort |
ET INFO Observed UA-OS Header |
rev 1 |
2025-06-03 |
| suricata |
ET INFO Observed UA-OS Header |
rev 1 |
2025-06-03 |
| suricata |
ET MALWARE JanelaRAT CnC Checkin Observed |
rev 5 |
2025-06-03 |
| suricata |
ET INFO Observed UA-Disp Header |
rev 1 |
2025-06-03 |
| suricata |
ET INFO Observed UA-Color Header |
rev 1 |
2025-06-03 |
| suricata |
ET INFO Observed UA-CPU Header |
rev 1 |
2025-06-03 |
| suricata |
ET MALWARE JanelaRAT Delivery Script Retrieving .MSI |
rev 1 |
2025-06-03 |
| suricata |
ET MALWARE JanelaRAT Staging URL |
rev 1 |
2025-06-03 |
| suricata |
ET INFO Observed UA-Pixels Header |
rev 1 |
2025-06-03 |
| sigma |
DNS Query To Common Malware Hosting and Shortener Services |
experimental |
2025-06-02 |
| snort |
ET INFO Observed dir Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed tasklist Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed Event Log Information From Internal Host Over UDP |
rev 1 |
2025-05-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.readymindit .com domain |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed net user Output From Internal Host Over UDP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed netsh advfirewall Output From Internal Host Over UDP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed netstat Output From Internal Host Over UDP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed net localgroup Output From Internal Host Over UDP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed powershell Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed ipconfig Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed tasklist Output From Internal Host Over UDP |
rev 1 |
2025-05-30 |
| snort |
ET TROJAN ICMP-GOSH Magic Bytes via ICMP Error |
rev 1 |
2025-05-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.readymindit .com domain |
rev 1 |
2025-05-30 |
| snort |
ET INFO Observed netstat Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| suricata |
ET INFO Observed dir Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| suricata |
ET INFO Observed tasklist Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| suricata |
ET MALWARE ICMP-GOSH Magic Bytes via ICMP Error |
rev 1 |
2025-05-30 |