| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.lifepixeled .com domain |
rev 1 |
2025-05-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mappuchan .com domain |
rev 1 |
2025-05-01 |
| snort |
ET TROJAN Gremlin Stealer CnC Successful Exfil Confirmation |
rev 1 |
2025-04-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.incorpnow .cn domain |
rev 1 |
2025-04-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.incorpnow .cn domain |
rev 1 |
2025-04-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.spoggi .com domain |
rev 1 |
2025-04-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.spoggi .com domain |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.incorpnow .cn domain |
rev 1 |
2025-04-29 |
| suricata |
ET MALWARE Gremlin Stealer CnC Successful Exfil Confirmation |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.spoggi .com domain |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.spoggi .com domain |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.incorpnow .cn domain |
rev 1 |
2025-04-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| sigma |
Cisco Modify Configuration |
test |
2025-04-28 |
| sigma |
Suspicious Child Process of SAP NetWeaver - Linux |
experimental |
2025-04-28 |
| sigma |
Potential SAP NetWeaver Webshell Creation - Linux |
experimental |
2025-04-28 |
| sigma |
Suspicious Child Process of SAP NetWeaver |
experimental |
2025-04-28 |
| sigma |
Potential SAP NetWeaver Webshell Creation |
experimental |
2025-04-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| snort |
ET INFO Gamaredon APT Style Delimiter Observed In HTTP Header |
rev 1 |
2025-04-25 |
| snort |
ET TROJAN Gamaredon APT Style Delimiter Observed In HTTP User-Agent |
rev 1 |
2025-04-25 |
| snort |
ET TROJAN Gamaredon APT Style Delimiter Observed In HTTP URI |
rev 1 |
2025-04-25 |
| suricata |
ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP URI |
rev 1 |
2025-04-25 |
| suricata |
ET HUNTING Gamaredon APT Style Delimiter Observed In HTTP Header |
rev 1 |
2025-04-25 |
| suricata |
ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP User-Agent |
rev 1 |
2025-04-25 |
| suricata |
ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP Cookie |
rev 1 |
2025-04-25 |
| snort |
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain |
rev 1 |
2025-04-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |
| snort |
ET ATTACK_RESPONSE ClickFix Related Payload Inbound |
rev 1 |
2025-04-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |
| suricata |
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain |
rev 1 |
2025-04-24 |
| suricata |
ET ATTACK_RESPONSE ClickFix Related Payload Inbound |
rev 1 |
2025-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |