| suricata |
ET PHISHING NOTG Phish Kit Visitor Fingerprinting |
rev 1 |
2025-02-19 |
| sigma |
Potential CVE-2024-35250 Exploitation Activity |
experimental |
2025-02-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.globalwireandcable .com domain |
rev 1 |
2025-02-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.globalwireandcable .com domain |
rev 1 |
2025-02-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.logistica .com .mx domain |
rev 1 |
2025-02-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.shein .ca domain |
rev 1 |
2025-02-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ostrovsky .sk domain |
rev 1 |
2025-02-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.logistica .com .mx domain |
rev 1 |
2025-02-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ostrovsky .sk domain |
rev 1 |
2025-02-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.shein .ca domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.logistica .com .mx domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.globalwireandcable .com domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.shein .ca domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ostrovsky .sk domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.globalwireandcable .com domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.logistica .com .mx domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.shein .ca domain |
rev 1 |
2025-02-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ostrovsky .sk domain |
rev 1 |
2025-02-18 |
| sigma |
Suspicious Autorun Registry Modified via WMI |
experimental |
2025-02-17 |
| sigma |
Suspicious PowerShell Invocations - Specific |
test |
2025-02-17 |
| sigma |
Suspicious PowerShell Invocations - Specific - PowerShell Module |
test |
2025-02-17 |
| sigma |
Suspicious Run Key from Download |
test |
2025-02-17 |
| sigma |
Potential Persistence Attempt Via Run Keys Using Reg.EXE |
test |
2025-02-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.kendimas .com domain |
rev 1 |
2025-02-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.kendimas .com domain |
rev 1 |
2025-02-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.kendimas .com domain |
rev 1 |
2025-02-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.kendimas .com domain |
rev 1 |
2025-02-15 |
| sigma |
Schtasks Creation Or Modification With SYSTEM Privileges |
test |
2025-02-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.solarorbit .net domain |
rev 1 |
2025-02-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.solarorbit .net domain |
rev 1 |
2025-02-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.solarorbit .net domain |
rev 1 |
2025-02-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.solarorbit .net domain |
rev 1 |
2025-02-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.garymcgill .ca domain |
rev 1 |
2025-02-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.garymcgill .ca domain |
rev 1 |
2025-02-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.garymcgill .ca domain |
rev 1 |
2025-02-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.garymcgill .ca domain |
rev 1 |
2025-02-12 |
| sigma |
Kalambur Backdoor Curl TOR SOCKS Proxy Execution |
experimental |
2025-02-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.serprise .com domain |
rev 1 |
2025-02-10 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2025-02-10 |
rev 1 |
2025-02-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.serprise .com domain |
rev 1 |
2025-02-10 |