| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cthulhu .li domain |
rev 1 |
2026-09-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.brianneburnell .com domain |
rev 1 |
2026-09-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cthulhu .li domain |
rev 1 |
2026-09-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.brianneburnell .com domain |
rev 1 |
2026-09-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cthulhu .li domain |
rev 1 |
2026-09-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.brianneburnell .com domain |
rev 1 |
2026-09-21 |
| suricata |
ET MALWARE GateSentinel C2 RemoteTool Heartbeat |
rev 1 |
2026-09-21 |
| suricata |
ET MALWARE GateSentinel C2 RemoteTool Registration |
rev 1 |
2026-09-21 |
| snort |
ET TROJAN GateSentinel C2 RemoteTool Heartbeat |
rev 1 |
2026-09-21 |
| snort |
ET TROJAN GateSentinel C2 RemoteTool Registration |
rev 1 |
2026-09-21 |
| splunk |
Creation of lsass Dump with Taskmgr |
production |
2026-09-21 |
| splunk |
Suspicious wevtutil Usage |
production |
2026-09-21 |
| splunk |
Windows Process Injection into Notepad |
deprecated |
2026-09-21 |
| splunk |
Windows Eventlog Cleared Via Wevtutil |
production |
2026-09-21 |
| elastic |
SMB (Windows File Sharing) Activity to the Internet |
production |
2026-09-21 |
| elastic |
RPC (Remote Procedure Call) from the Internet |
production |
2026-09-21 |
| elastic |
RPC (Remote Procedure Call) to the Internet |
production |
2026-09-21 |
| elastic |
SMB (Windows File Sharing) Activity from the Internet |
production |
2026-09-21 |
| elastic |
Accepted Default Telnet Port Connection |
production |
2026-09-21 |
| splunk |
MacOS Osascript Executing Interactive Shell |
production |
2026-09-18 |
| splunk |
Cisco NVM - Osascript Network Connection for a Long Duration |
production |
2026-09-18 |
| splunk |
MacOS Osascript Executing JavaScript Code With ObjC |
production |
2026-09-18 |
| elastic |
Potential Tunneling via AWS IoT Secure Tunneling Localproxy |
production |
2026-09-18 |
| splunk |
MacOS - Re-opened Applications |
deprecated |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Application |
production |
2026-09-18 |
| elastic |
Malicious File - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Get or List with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
AWS Batch Job Submitted with Container Override by Unusual Identity |
production |
2026-09-18 |
| elastic |
High Number of Process Terminations |
production |
2026-09-18 |
| elastic |
Kubernetes Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-09-18 |
| elastic |
MFA Deactivation with no Re-Activation for Okta User Account |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` with Run Shell Command Parameters |
production |
2026-09-18 |
| elastic |
Uncommon DNS Request via Bun or Node.js |
production |
2026-09-18 |
| elastic |
Active Directory Discovery using AdExplorer |
production |
2026-09-18 |
| elastic |
AWS SSM Inventory Reconnaissance by Rare User |
production |
2026-09-18 |
| elastic |
AWS KMS Key Policy Updated via PutKeyPolicy |
production |
2026-09-18 |
| elastic |
AWS SageMaker Execution Role Passed by Unusual Principal |
production |
2026-09-18 |
| elastic |
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation |
production |
2026-09-18 |
| elastic |
Command Line Obfuscation via Whitespace Padding |
production |
2026-09-18 |
| elastic |
Google Workspace API Access Granted via Domain-Wide Delegation |
production |
2026-09-18 |