| snort |
ET INFO GET to ip .ipify .org via WinHTTP |
rev 1 |
2026-09-11 |
| suricata |
ET MALWARE GemStone Gemini Chrome Extension CnC - Poll Commands |
rev 1 |
2026-09-11 |
| suricata |
ET MALWARE GemStone Gemini Chrome Extension CnC - Screenshots |
rev 1 |
2026-09-11 |
| suricata |
ET MALWARE GemStone Gemini Chrome Extension CnC - Heartbeat |
rev 1 |
2026-09-11 |
| suricata |
ET MALWARE GemStone Gemini Chrome Extension CnC - Register |
rev 1 |
2026-09-11 |
| suricata |
ET MALWARE GemStone Gemini Chrome Extension CnC - Ingest |
rev 1 |
2026-09-11 |
| suricata |
ET MALWARE GemStone Gemini Chrome Extension CnC - Command Results |
rev 1 |
2026-09-11 |
| suricata |
ET HUNTING GET to ip .ipify .org via WinHTTP |
rev 1 |
2026-09-11 |
| snort |
ET CURRENT_EVENTS Darksword iOS EK Landing Page |
rev 1 |
2026-09-10 |
| snort |
ET RETIRED Foxit PDF Reader Title Stack Overflow |
rev 5 |
2026-09-10 |
| snort |
ET CURRENT_EVENTS Darksword iOS EK RCE Worker Page |
rev 1 |
2026-09-10 |
| snort |
ET CURRENT_EVENTS Darksword iOS EK RCE Loader Page |
rev 1 |
2026-09-10 |
| suricata |
ET RETIRED Foxit PDF Reader Title Stack Overflow |
rev 6 |
2026-09-10 |
| suricata |
ET EXPLOIT_KIT Darksword iOS EK RCE Loader Page |
rev 1 |
2026-09-10 |
| suricata |
ET EXPLOIT_KIT Darksword iOS EK RCE Worker Page |
rev 1 |
2026-09-10 |
| suricata |
ET EXPLOIT_KIT Darksword iOS EK Landing Page |
rev 1 |
2026-09-10 |
| splunk |
XMRIG Driver Loaded |
deprecated |
2026-09-08 |
| splunk |
ESXi Bulk VM Termination |
production |
2026-09-08 |
| splunk |
Plain HTTP POST Exfiltrated Data |
production |
2026-09-08 |
| splunk |
Nginx ConnectWise ScreenConnect Authentication Bypass |
production |
2026-09-08 |
| splunk |
Log4Shell JNDI Payload Injection with Outbound Connection |
production |
2026-09-08 |
| splunk |
Log4Shell JNDI Payload Injection Attempt |
production |
2026-09-08 |
| splunk |
CrushFTP Max Simultaneous Users From IP |
production |
2026-09-08 |
| splunk |
CrushFTP Authentication Bypass Exploitation |
production |
2026-09-08 |
| splunk |
Internal Horizontal Port Scan NMAP Top 20 |
production |
2026-09-08 |
| splunk |
DNS Kerberos Coercion |
production |
2026-09-08 |
| splunk |
Windows WMI Impersonate Token |
production |
2026-09-08 |
| splunk |
Windows Wermgr Alternate Data Stream in Temp Dir |
production |
2026-09-08 |
| splunk |
Windows Unusual File Creation in Confluence Directory |
production |
2026-09-08 |
| splunk |
Windows Unsecured Outlook Credentials Access In Registry |
production |
2026-09-08 |
| splunk |
Windows Terminating Lsass Process |
production |
2026-09-08 |
| splunk |
Windows Process Injection into Commonly Abused Processes |
production |
2026-09-08 |
| splunk |
Windows Possible Credential Dumping |
production |
2026-09-08 |
| splunk |
Windows Handle Duplication in Known UAC-Bypass Binaries |
production |
2026-09-08 |
| splunk |
Unusually Long Content-Type Length |
experimental |
2026-09-08 |
| splunk |
Cisco IOS XE WebUI Programmatic Configuration |
production |
2026-09-08 |
| splunk |
Rubeus Kerberos Ticket Exports Through Winlogon Access |
production |
2026-09-08 |
| splunk |
ESXi Audit Tampering |
production |
2026-09-08 |
| splunk |
Windows Access Token Manipulation Winlogon Duplicate Token Handle |
production |
2026-09-08 |
| splunk |
Detect Credential Dumping through LSASS access |
production |
2026-09-08 |