| snort |
ET TOR Known Tor Exit Node TCP Traffic group 129 |
rev 6395 |
2026-10-02 |
| snort |
ET CINS Active Threat Intelligence Poor Reputation IP UDP group 147 |
rev 112154 |
2026-10-02 |
| snort |
ET CINS Active Threat Intelligence Poor Reputation IP UDP group 156 |
rev 112154 |
2026-10-02 |
| snort |
ET CINS Active Threat Intelligence Poor Reputation IP TCP group 163 |
rev 112154 |
2026-10-02 |
| snort |
ET CINS Active Threat Intelligence Poor Reputation IP UDP group 166 |
rev 112154 |
2026-10-02 |
| snort |
ET CINS Active Threat Intelligence Poor Reputation IP UDP group 165 |
rev 112154 |
2026-10-02 |
| elastic |
Base64 Decoded Payload Piped to Interpreter |
production |
2026-10-02 |
| splunk |
Child Processes of Spoolsv exe |
deprecated |
2026-10-02 |
| sigma |
Renamed Schtasks Execution |
experimental |
2026-10-02 |
| suricata |
ET MALWARE PackClient RAT C2 Information Request |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Desktop Screen Capture Exfiltration |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Heartbeat Response From C2 |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Status Checkin Message - From Server |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT C2 Information Request - Client Response |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient Core startup probe state |
rev 1 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Client Heartbeat |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Payload Request |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Payload Request - C2 Response |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Payload Data Recieved Acknowledgement |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient Core startup response state |
rev 1 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT Status Checkin Message - From Client |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT CnC Checkin M1 |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT CnC Checkin M2 |
rev 2 |
2026-10-01 |
| suricata |
ET MALWARE PackClient RAT CnC Checkin M2 - C2 Response |
rev 2 |
2026-10-01 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Cookie |
rev 1 |
2026-10-01 |
| snort |
ET TROJAN PackClient Core startup response state |
rev 1 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT Desktop Screen Capture Exfiltration |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient Core startup probe state |
rev 1 |
2026-10-01 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Cookie |
rev 1 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT C2 Information Request - Client Response |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT Client Heartbeat |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT Heartbeat Response From C2 |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT C2 Information Request |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT Status Checkin Message - From Server |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT CnC Checkin M2 - C2 Response |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT CnC Checkin M2 |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT Payload Request |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT Payload Request - C2 Response |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT CnC Checkin M1 |
rev 2 |
2026-10-01 |
| snort |
ET TROJAN PackClient RAT Payload Data Recieved Acknowledgement |
rev 2 |
2026-10-01 |