| sigma |
New DMSA Service Account Created in Specific OUs |
experimental |
2025-05-24 |
| sigma |
DMSA Service Account Created in Specific OUs - PowerShell |
experimental |
2025-05-24 |
| sigma |
Potential Abuse of Linux Magic System Request Key |
experimental |
2025-05-23 |
| snort |
ET TROJAN CHERRYSPY.Backdoor Russia APT28 Initial Key Exchange |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN Gamaredon APT TryCloudFlare CnC Activity - Known Delimiter in User-Agent |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN APT28 Russia Macro Loader HTTP POST |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN CHERRYSPY.Backdoor Russia APT28 Key Exchange Response |
rev 1 |
2025-05-22 |
| snort |
ET EXPLOIT Windows Microsoft .XRM-MS File / NTLM Information Disclosure |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN HATVIBE.loader Russia APT28 HTTP PUT Request |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE CHERRYSPY.Backdoor Russia APT28 Initial Key Exchange |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE CHERRYSPY.Backdoor Russia APT28 Key Exchange Response |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE APT28 Russia Macro Loader HTTP POST |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE HATVIBE.loader Russia APT28 HTTP PUT Request |
rev 1 |
2025-05-22 |
| suricata |
ET EXPLOIT Windows Microsoft .XRM-MS File / NTLM Information Disclosure |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE Gamaredon APT TryCloudFlare CnC Activity - Known Delimiter in User-Agent |
rev 1 |
2025-05-22 |
| sigma |
Registry Export of Third-Party Credentials |
experimental |
2025-05-22 |
| sigma |
Enumeration for 3rd Party Creds From CLI |
test |
2025-05-22 |
| sigma |
Suspicious File Access to Browser Credential Storage |
experimental |
2025-05-22 |
| sigma |
Suspicious Deno File Written from Remote Source |
experimental |
2025-05-22 |
| sigma |
Katz Stealer Suspicious User-Agent |
experimental |
2025-05-22 |
| sigma |
DNS Query To Katz Stealer Domains - Network |
experimental |
2025-05-22 |
| sigma |
Katz Stealer DLL Loaded |
experimental |
2025-05-22 |
| sigma |
DNS Query To Katz Stealer Domains |
experimental |
2025-05-22 |
| sigma |
Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE |
experimental |
2025-05-20 |
| snort |
ET RETIRED BunnyLoader Heartbeat Acknowledgement |
rev 2 |
2025-05-19 |
| suricata |
ET MALWARE Interlock Ransomware Fake Updater CnC Callback |
rev 3 |
2025-05-19 |
| suricata |
ET RETIRED BunnyLoader Heartbeat Acknowledgement |
rev 2 |
2025-05-19 |
| sigma |
Remote Access Tool - Renamed MeshAgent Execution - Windows |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - Potential MeshAgent Execution - Windows |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - Renamed MeshAgent Execution - MacOS |
experimental |
2025-05-19 |
| sigma |
HackTool - Impacket File Indicators |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - Potential MeshAgent Execution - MacOS |
experimental |
2025-05-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.jaypetroleum .com domain |
rev 1 |
2025-05-16 |
| snort |
ET TROJAN Interlock RAT CnC Checkin |
rev 1 |
2025-05-16 |
| snort |
ET TROJAN Interlock Ransomware Fake Updater CnC Callback |
rev 3 |
2025-05-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.jaypetroleum .com domain |
rev 1 |
2025-05-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.jaypetroleum .com domain |
rev 1 |
2025-05-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.jaypetroleum .com domain |
rev 1 |
2025-05-16 |
| suricata |
ET MALWARE Interlock RAT CnC Checkin |
rev 1 |
2025-05-16 |
| suricata |
ET WEB_SPECIFIC_APPS Winstar WN572HP3 upload.cgi HTTP Cookie buffer overflow attempt |
rev 1 |
2025-05-15 |