| snort |
ET EXPLOIT SSH Client Key Exchange Init Cookie Null |
rev 2 |
2025-04-23 |
| snort |
ET TROJAN StealC v2 Fake 404 Page Observed |
rev 1 |
2025-04-22 |
| snort |
ET TROJAN Interlock RAT CnC Checkin |
rev 1 |
2025-04-22 |
| suricata |
ET MALWARE StealC v2 Fake 404 Page Observed |
rev 1 |
2025-04-22 |
| suricata |
ET MALWARE Interlock RAT CnC Checkin |
rev 1 |
2025-04-22 |
| snort |
ET WEB_SPECIFIC_APPS Yi IOT XY-3820 cmd Service Unauthenticated Remote Code Execution Attempt |
rev 1 |
2025-04-21 |
| snort |
ET TROJAN UNK NSFWBot CnC Command Inbound |
rev 1 |
2025-04-21 |
| snort |
ET INFO HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header |
rev 1 |
2025-04-21 |
| snort |
ET EXPLOIT Belkin N750 Buffer Overflow Attempt |
rev 1 |
2025-04-21 |
| snort |
ET TROJAN UNK NSFWBot C2 Additional Time Request |
rev 1 |
2025-04-21 |
| suricata |
ET MALWARE UNK NSFWBot CnC Command Inbound |
rev 1 |
2025-04-21 |
| suricata |
ET MALWARE UNK NSFWBot C2 Additional Time Request |
rev 1 |
2025-04-21 |
| suricata |
ET EXPLOIT Belkin N750 Buffer Overflow Attempt |
rev 1 |
2025-04-21 |
| suricata |
ET HUNTING HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header |
rev 1 |
2025-04-21 |
| suricata |
ET WEB_SPECIFIC_APPS Yi IOT XY-3820 cmd Service Unauthenticated Remote Code Execution Attempt |
rev 1 |
2025-04-21 |
| sigma |
Potentially Suspicious Inline JavaScript Execution via NodeJS Binary |
experimental |
2025-04-21 |
| sigma |
NodeJS Execution of JavaScript File |
experimental |
2025-04-21 |
| sigma |
Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit |
experimental |
2025-04-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mushkoorfoods .co .uk domain |
rev 1 |
2025-04-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mushkoorfoods .co .uk domain |
rev 1 |
2025-04-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mushkoorfoods .co .uk domain |
rev 1 |
2025-04-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mushkoorfoods .co .uk domain |
rev 1 |
2025-04-19 |
| snort |
ET ATTACK_RESPONSE ClickFix Webpage Inbound |
rev 1 |
2025-04-18 |
| suricata |
ET ATTACK_RESPONSE ClickFix Webpage Inbound |
rev 1 |
2025-04-18 |
| snort |
ET RETIRED Suspected Andariel RexPot CnC Checkin M1 |
rev 2 |
2025-04-17 |
| snort |
ET RETIRED MacOS/RustBucket System Information Exfiltration Attempt |
rev 3 |
2025-04-17 |
| snort |
ET RETIRED Win32/Delf.TJJ CnC Checkin M1 |
rev 2 |
2025-04-17 |
| snort |
ET RETIRED Suspicious Request for bd.log |
rev 2 |
2025-04-17 |
| snort |
ET RETIRED BunnyLoader CnC Checkin - Heartbeat |
rev 4 |
2025-04-17 |
| snort |
ET RETIRED Red Wolf/RedCurl Payload Retrieval Attempt M5 |
rev 2 |
2025-04-17 |
| snort |
ET RETIRED [ANY.RUN] Remcos RAT Checkin 861 |
rev 2 |
2025-04-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.budjettravel .net domain |
rev 1 |
2025-04-17 |
| snort |
ET RETIRED Suspicious Request for fs.log |
rev 2 |
2025-04-17 |
| snort |
ET TROJAN CHStealer getshortinfo Command CnC Checkin |
rev 1 |
2025-04-17 |
| snort |
ET RETIRED TA453 IIS Credential Stealer Module/Backdoor Headers in HTTP Request |
rev 2 |
2025-04-17 |
| snort |
ET TROJAN CHStealer checkping Command CnC Checkin |
rev 1 |
2025-04-17 |
| snort |
ET RETIRED [ANY.RUN] ZharkBOT HTTP CnC Checkin |
rev 2 |
2025-04-17 |
| snort |
ET RETIRED TA453 BellaCiao ASPX Backdoor User-Agent in HTTP Request |
rev 3 |
2025-04-17 |
| snort |
ET RETIRED TA453 Modified IIS-Raid Backdoor Module Headers in HTTP Request |
rev 2 |
2025-04-17 |
| snort |
ET RETIRED BunnyLoader CnC Tasking Response |
rev 2 |
2025-04-17 |