| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.gz-associates .com domain |
rev 1 |
2026-09-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.coadautodoor .com domain |
rev 1 |
2026-09-30 |
| elastic |
GKE Unusual Service Account Secret Access via New User Agent |
deprecated |
2026-09-29 |
| elastic |
First Time Python Spawned a Shell on Host |
production |
2026-09-29 |
| elastic |
First Time Python Created a LaunchAgent or LaunchDaemon |
production |
2026-09-29 |
| elastic |
First Time Python Accessed Sensitive Credential Files |
production |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M1 |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE Generic PowerShell Loader Inbound |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M3 |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M4 |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M5 |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M2 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M3 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M4 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M5 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M1 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN Generic PowerShell Loader Inbound |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M2 |
rev 1 |
2026-09-29 |
| elastic |
Entra ID Application Credential Modified |
production |
2026-09-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hosteriafutaleufu .cl domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hosteriafutaleufu .cl domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ploteando .com domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.techmaxasia .com domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cafemeridiano .com .br domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ploteando .com domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.techmaxasia .com domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cafemeridiano .com .br domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.techmaxasia .com domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cafemeridiano .com .br domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.happypc .ca domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.happypc .ca domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.techmaxasia .com domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.cafemeridiano .com .br domain |
rev 1 |
2026-09-28 |
| splunk |
Windows Crowdstrike RTR Script Execution |
production |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hosteriafutaleufu .cl domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.happypc .ca domain |
rev 1 |
2026-09-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ploteando .com domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.happypc .ca domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ploteando .com domain |
rev 1 |
2026-09-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hosteriafutaleufu .cl domain |
rev 1 |
2026-09-28 |