Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1071

Application Layer Protocol

Command and Control 791 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
suricata ET MALWARE PolinRider Loader CnC Checkin rev 1 2026-10-28
snort ET TROJAN PolinRider Loader CnC Checkin rev 1 2026-10-28
snort ET TROJAN UNK_PolyPocket Related Victim Exfil rev 1 2026-10-21
suricata ET MALWARE UNK_PolyPocket Related Victim Exfil rev 1 2026-10-21
elastic Connection to Commonly Abused Web Services production 2026-10-19
snort ET TROJAN Generic PowerShell Loader Payload Request rev 1 2026-10-12
suricata ET MALWARE Generic PowerShell Loader Payload Request rev 1 2026-10-12
elastic Network Activity to a Suspicious Top Level Domain production 2026-10-09
suricata ET MALWARE CountLoader CnC Checkin rev 1 2026-10-08
suricata ET MALWARE CountLoader CnC Task Request rev 1 2026-10-08
snort ET TROJAN CountLoader CnC Checkin rev 1 2026-10-08
elastic Connection to External Network via Telnet production 2026-10-08
snort ET TROJAN CountLoader CnC Task Request rev 1 2026-10-08
suricata ET MALWARE CountLoader Payload Request rev 1 2026-10-08
snort ET TROJAN CountLoader Payload Request rev 1 2026-10-08
suricata ET MALWARE CountLoader Victim Send Task Execution Result rev 1 2026-10-08
snort ET TROJAN CountLoader Victim Send Task Execution Result rev 1 2026-10-08
elastic First Seen External MQTT Broker Connection production 2026-10-06
elastic Cobalt Strike Command and Control Beacon production 2026-10-06
elastic Halfbaked Command and Control Beacon production 2026-10-06
elastic Possible FIN7 DGA Command and Control Behavior production 2026-10-06
elastic Suspicious Linux Process Connection to AWS IoT Core MQTT production 2026-10-06
elastic Potential Reverse Shell via Java production 2026-10-05
elastic Unusual File Creation via Web Server production 2026-09-27
elastic Execution via OpenClaw Agent production 2026-09-25
elastic GenAI Process Connection to Unusual Domain production 2026-09-25
elastic GenAI Process Connection to Suspicious Top Level Domain production 2026-09-25
elastic Anthropic Activity from a Suspicious User Agent production 2026-09-25
suricata ET MALWARE Exvicy CnC Panel Checkin rev 2 2026-09-24
suricata ET MALWARE Exvicy CnC Panel Response rev 2 2026-09-24
snort ET TROJAN Exvicy CnC Panel Response rev 2 2026-09-24
snort ET TROJAN Exvicy CnC Panel Checkin rev 2 2026-09-24
snort ET TROJAN GateSentinel C2 RemoteTool Registration rev 1 2026-09-21
snort ET TROJAN GateSentinel C2 RemoteTool Heartbeat rev 1 2026-09-21
suricata ET MALWARE GateSentinel C2 RemoteTool Registration rev 1 2026-09-21
suricata ET MALWARE GateSentinel C2 RemoteTool Heartbeat rev 1 2026-09-21
elastic Potential DNS Tunneling via NULL or Long DNS Queries production 2026-09-21
elastic Accepted Default Telnet Port Connection production 2026-09-21
elastic Potential DNS Tunneling via NsLookup production 2026-09-18
elastic Potential File Transfer via Certreq production 2026-09-18
elastic Potential Self-Signed TLS Certificate Recently Issued on External Connection production 2026-09-18
elastic SMTP to the Internet on Port 26/TCP production 2026-09-18
elastic Default Cobalt Strike Team Server Certificate production 2026-09-18
elastic Unusual Windows Network Activity production 2026-09-18
elastic Entra ID Protection - Risk Detection - User Risk production 2026-09-18
elastic Spike in Network Traffic To a Country production 2026-09-18
elastic Network Traffic to Rare Destination Country production 2026-09-18
elastic Unusual Network Destination Domain Name production 2026-09-18
elastic Unusual Linux Network Port Activity production 2026-09-18
elastic Unusual Linux Network Activity production 2026-09-18
elastic Spike in Firewall Denies production 2026-09-18
elastic Statistical Model Detected C2 Beaconing Activity production 2026-09-18
elastic Statistical Model Detected C2 Beaconing Activity with High Confidence production 2026-09-18
elastic Spike in host-based traffic production 2026-09-18
elastic Unusual DNS Activity production 2026-09-18
elastic Unusual Web User Agent production 2026-09-18
elastic Unusual Web Request production 2026-09-18
elastic DNS Tunneling production 2026-09-18
elastic Apple Script Execution followed by Network Connection production 2026-09-18
elastic Suspicious Installer Package Spawns Network Event production 2026-09-18
elastic Unusual Network Connection to Suspicious Web Service production 2026-09-18
elastic Unusual Network Connection to Suspicious Top Level Domain production 2026-09-18
elastic Suspicious Curl to Google App Script Endpoint production 2026-09-18
elastic File Download Detected via Defend for Containers production 2026-09-18
elastic Suspicious Process Execution Detected via Defend for Containers production 2026-09-18
elastic File Creation and Execution Detected via Defend for Containers production 2026-09-18
elastic Machine Learning Detected a DNS Request Predicted to be a DGA Domain production 2026-09-18
elastic High Number of Egress Network Connections from Unusual Executable production 2026-09-18
suricata ET MALWARE MakinoLoader Victim HeartBeat rev 1 2026-09-18
elastic Suspicious Curl from macOS Application production 2026-09-18
elastic Perl Outbound Network Connection production 2026-09-18
elastic Root Network Connection via GDB CAP_SYS_PTRACE production 2026-09-18
elastic Unusual Command Execution via Web Server production 2026-09-18
elastic Unusual Child Execution via Web Server production 2026-09-18
elastic Simple HTTP Web Server Creation production 2026-09-18
elastic Curl or Wget Spawned via Node.js production 2026-09-18
elastic PANW and Elastic Defend - Command and Control Correlation production 2026-09-18
elastic Suricata and Elastic Defend Network Correlation production 2026-09-18
elastic Uncommon DNS Request via Bun or Node.js production 2026-09-18
elastic Simple HTTP Web Server Connection production 2026-09-18
elastic Git Hook Egress Network Connection production 2026-09-18
elastic Potential Malware-Driven SSH Brute Force Attempt production 2026-09-18
elastic Suspicious Named Pipe Creation production 2026-09-18
elastic Potential Reverse Shell via UDP production 2026-09-18
elastic Potential Reverse Shell production 2026-09-18
elastic Potential Reverse Shell via Suspicious Binary production 2026-09-18
snort ET TROJAN MakinoLoader CnC Checkin rev 1 2026-09-18
snort ET TROJAN MakinoLoader Victim HeartBeat rev 1 2026-09-18
suricata ET MALWARE MakinoLoader CnC Checkin rev 1 2026-09-18
elastic Web Server Potential Command Injection Request production 2026-09-18
elastic Web Server Potential SQL Injection Request production 2026-09-18
elastic Entra ID Protection - Risk Detection - Sign-in Risk production 2026-09-18
elastic Potential Tunneling via AWS IoT Secure Tunneling Localproxy production 2026-09-18
elastic Suspicious Execution from a WebDav Share production 2026-09-18
elastic Java Dropped and Executed With DNS Lookup production 2026-09-18
elastic Network Connection via Compiled HTML File production 2026-09-18
elastic Suspicious Command Prompt Network Connection production 2026-09-18
elastic System Public IP Discovery via DNS Query production 2026-09-18
elastic Unusual Network Connection via RunDLL32 production 2026-09-18
elastic Unusual Network Connection via DllHost production 2026-09-18
elastic MsBuild Making Network Connections production 2026-09-18
elastic Potential File Transfer via Curl for Windows production 2026-09-18
elastic Outlook Home Page Registry Modification production 2026-09-18
elastic Potential Command and Control via Internet Explorer production 2026-09-18
elastic Openssl Client or Server Activity production 2026-09-18
elastic Payload Downloaded by Interpreter and Piped to Interpreter production 2026-09-18
elastic File Downloaded by Curl/Wget and Piped to Interpreter production 2026-09-18
elastic Network Connection via Recently Compiled Executable production 2026-09-18
elastic Network Connection from Binary with RWX Memory Region production 2026-09-18
elastic Egress Connection from Entrypoint in Container production 2026-09-18
elastic Suspicious Command Execution via Busybox Proxy production 2026-09-18
elastic Linux Telegram API Request production 2026-09-18
elastic Suspicious Network Activity to the Internet by Previously Unknown Executable production 2026-09-18
elastic Network Connection Followed by File Creation production 2026-09-18
elastic Potential Linux Tunneling and/or Port Forwarding production 2026-09-18
elastic Payload Execution via Shell Pipe Detected by Defend for Containers production 2026-09-18
elastic Git Repository or File Download to Suspicious Directory production 2026-09-18
elastic Suspicious Interpreter Execution Detected via Defend for Containers production 2026-09-18
elastic Web Server Exploitation Detected via Defend for Containers production 2026-09-18
elastic Machine Learning Detected DGA activity using a known SUNBURST DNS domain production 2026-09-18
elastic Potential DGA Activity production 2026-09-18
elastic Machine Learning Detected a DNS Request With a High DGA Probability Score production 2026-09-18
elastic Unusual DNS Request to Suspicious Top Level Domain production 2026-09-18
elastic System Path File Creation and Execution Detected via Defend for Containers production 2026-09-18
elastic Potential Meterpreter Reverse Shell production 2026-09-18
elastic Potential Reverse Shell via Suspicious Child Process production 2026-09-18
elastic Potential Reverse Shell via Child production 2026-09-18
elastic Potential Reverse Shell via Background Process production 2026-09-18
elastic Suspicious Linux Process Connection to Bulletproof Hosting ASN production 2026-09-17
splunk Windows Finger.exe Connecting to a Remote Host production 2026-09-16
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Poll Commands rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Screenshots rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Ingest rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Heartbeat rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Register rev 1 2026-09-11
snort ET TROJAN GemStone Gemini Chrome Extension CnC - Command Results rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Ingest rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Register rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Heartbeat rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Command Results rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Poll Commands rev 1 2026-09-11
suricata ET MALWARE GemStone Gemini Chrome Extension CnC - Screenshots rev 1 2026-09-11
suricata ET MALWARE TonRAT CnC Request to TonAPI Dead Drop Resolver rev 1 2026-09-02
suricata ET MALWARE Grizzly Loader Config Inbound M2 rev 1 2026-08-31
suricata ET MALWARE Grizzly Loader Config Inbound M1 rev 1 2026-08-31
snort ET TROJAN Grizzly Loader Config Inbound M2 rev 1 2026-08-31
snort ET TROJAN Grizzly Loader Config Inbound M1 rev 1 2026-08-31
suricata ET MALWARE GET Request to Minecraft Java Edition Port with Custom X-Header rev 4 2026-08-27
snort ET TROJAN GET Request to Minecraft Java Edition Port with Custom X-Header rev 4 2026-08-27
snort ET TROJAN DeviceManager CnC HTTP Requests - Result Submission rev 1 2026-08-25
suricata ET MALWARE DeviceManager CnC HTTP Requests - Result Submission rev 1 2026-08-25
suricata ET MALWARE DeviceManager CnC HTTP Requests - Task Polling rev 1 2026-08-25
snort ET TROJAN DeviceManager CnC DNS Communication - Status Update rev 1 2026-08-25
snort ET TROJAN DeviceManager CnC HTTP Requests - Checkin rev 1 2026-08-25
snort ET TROJAN DeviceManager CnC HTTP Requests - Task Polling rev 1 2026-08-25
suricata ET MALWARE DeviceManager CnC HTTP Requests - Checkin rev 1 2026-08-25
suricata ET MALWARE DeviceManager CnC DNS Communication - Status Update rev 1 2026-08-25
suricata ET HUNTING GET Request to Minecraft Java Edition Port rev 1 2026-08-24
snort ET INFO GET Request to Minecraft Java Edition Port rev 1 2026-08-24
elastic Deprecated - SUNBURST Command and Control Activity deprecated 2026-08-19
splunk Windows App Layer Protocol Wermgr Connect To NamedPipe production 2026-08-18
snort ET TROJAN OWAReaper C2 Beacon rev 1 2026-07-28
suricata ET MALWARE OWAReaper C2 Beacon rev 1 2026-07-28
suricata ET MALWARE IceCube JS Backdoor C2 Collect Info rev 1 2026-07-07
snort ET TROJAN IceCube JS Backdoor C2 Collect Info rev 1 2026-07-07
elastic Deprecated - Unusual Process Spawned from Web Server Parent deprecated 2026-07-02
elastic Deprecated - Uncommon Destination Port Connection by Web Server deprecated 2026-07-02
elastic Deprecated - Unusual Command Execution from Web Server Parent deprecated 2026-07-02
suricata ET MALWARE Observed AlfaRedFox RAT SSL Cert rev 1 2026-06-29
suricata ET MALWARE Observed DarkRAT SSL Cert rev 1 2026-06-29
suricata ET MALWARE Observed LMTeamRAT SSL Cert rev 1 2026-06-29
suricata ET EXPLOIT_KIT Clearfake Set-Cookie Inbound M1 rev 1 2026-06-12
suricata ET PHISHING Phish Link Click Confirmation via Telegram Bot rev 1 2026-05-18
snort ET CURRENT_EVENTS Phish Link Click Confirmation via Telegram Bot rev 1 2026-05-18
suricata ET MALWARE SainboxRAT CnC Config Request rev 1 2026-05-14
snort ET TROJAN SainboxRAT CnC Config Request rev 1 2026-05-14
splunk Cisco Secure Firewall - High Priority Intrusion Classification production 2026-05-13
splunk Windows Application Layer Protocol RMS Radmin Tool Namedpipe production 2026-05-13
splunk Windows App Layer Protocol Qakbot NamedPipe production 2026-05-13
splunk Cisco Secure Firewall - High Volume of Intrusion Events Per Host production 2026-05-13
suricata ET MALWARE MagicG Stealer CnC Exfil Confirmation rev 1 2026-05-11
snort ET TROJAN HumanitarianBait Infostealer CnC File Exfil rev 1 2026-05-11
snort ET TROJAN MagicG Stealer CnC Exfil Confirmation rev 1 2026-05-11
suricata ET MALWARE HumanitarianBait Infostealer CnC File Exfil rev 1 2026-05-11
suricata ET MALWARE TA582 CnC Checkin rev 2 2026-04-27
snort ET TROJAN TA582 CnC Checkin rev 2 2026-04-27
snort ET TROJAN APT36 Victim Beacon M2 rev 1 2026-04-24
suricata ET MALWARE APT36 Victim Beacon M2 rev 1 2026-04-24
suricata ET MALWARE APT36 Victim Beacon M1 rev 1 2026-04-24
snort ET TROJAN APT36 Victim Beacon M1 rev 1 2026-04-24
suricata ET MALWARE TeamPCP CanisterWorm - Namastex npm Campaign - Exfiltration rev 1 2026-04-23
snort ET TROJAN TeamPCP CanisterWorm - Namastex npm Campaign - Exfiltration rev 1 2026-04-23
suricata ET MALWARE COMSUON Stealer Exfil via Telegram rev 1 2026-04-16
snort ET TROJAN COMSUON Stealer Exfil via Telegram rev 1 2026-04-16
snort ET TROJAN SonOyuncu Stealer Exfil via Discord rev 1 2026-04-09
suricata ET MALWARE SonOyuncu Stealer User-Agent Observed rev 1 2026-04-09
suricata ET MALWARE SonOyuncu Stealer Exfil via Discord rev 1 2026-04-09
snort ET TROJAN SonOyuncu Stealer User-Agent Observed rev 1 2026-04-09
snort ET TROJAN AuraC2 Victim Beacon rev 1 2026-04-07
suricata ET MALWARE AuraC2 Victim Registration rev 1 2026-04-07
suricata ET MALWARE AuraC2 Victim Registration Confirmation rev 1 2026-04-07
snort ET TROJAN AuraC2 Victim Registration rev 1 2026-04-07
snort ET TROJAN AuraC2 Victim Registration Confirmation rev 1 2026-04-07
suricata ET MALWARE AuraC2 Exfil Confirmation rev 1 2026-04-07
suricata ET MALWARE AuraC2 Victim Beacon rev 1 2026-04-07
snort ET TROJAN AuraC2 Exfil Confirmation rev 1 2026-04-07
suricata ET MALWARE Crpx0 Ransomware User-Agent Observed rev 1 2026-04-02
snort ET TROJAN Crpx0 Ransomware User-Agent Observed rev 1 2026-04-02
snort ET TROJAN Crpx0 Ransomware Victim Profile Exfil rev 1 2026-04-02
suricata ET MALWARE Crpx0 Ransomware Victim Profile Exfil rev 1 2026-04-02
suricata ET MALWARE plain-crypto-js RAT Stage 1 C2 Outbound Request rev 1 2026-04-01
suricata ET MALWARE UNK_MonkeyWrench Payload Request rev 1 2026-04-01
snort ET TROJAN UNK_MonkeyWrench Payload Request rev 1 2026-04-01
snort ET TROJAN plain-crypto-js RAT Stage 1 C2 Outbound Request rev 1 2026-04-01
suricata ET MALWARE TeamPCP CnC Activity Observed rev 1 2026-03-27
snort ET TROJAN TeamPCP CnC Activity Observed rev 1 2026-03-27
snort ET TROJAN InstallFix MacOS CnC Activity M2 rev 1 2026-03-25
snort ET TROJAN InstallFix MacOS CnC Activity M1 rev 1 2026-03-25
suricata ET MALWARE InstallFix MacOS CnC Activity M1 rev 1 2026-03-25
suricata ET MALWARE InstallFix MacOS CnC Activity M3 rev 1 2026-03-25
suricata ET MALWARE InstallFix MacOS CnC Activity M2 rev 1 2026-03-25
snort ET TROJAN InstallFix MacOS CnC Activity M3 rev 1 2026-03-25
snort ET CURRENT_EVENTS Coruna Device Fingerprinting M2 rev 1 2026-03-09
suricata ET EXPLOIT_KIT Coruna Device Fingerprinting M1 rev 1 2026-03-09
suricata ET EXPLOIT_KIT Coruna Device Fingerprinting M2 rev 1 2026-03-09
suricata ET EXPLOIT_KIT Coruna Device Fingerprinting M3 rev 1 2026-03-09
suricata ET EXPLOIT_KIT Coruna Device Fingerprinting M4 rev 1 2026-03-09
suricata ET EXPLOIT_KIT Coruna Device Fingerprinting M5 rev 1 2026-03-09
snort ET CURRENT_EVENTS Coruna Device Fingerprinting M1 rev 1 2026-03-09
snort ET CURRENT_EVENTS Coruna Device Fingerprinting M3 rev 1 2026-03-09
snort ET CURRENT_EVENTS Coruna Device Fingerprinting M4 rev 1 2026-03-09
snort ET CURRENT_EVENTS Coruna Device Fingerprinting M5 rev 1 2026-03-09
suricata ET MALWARE TA450 CnC Victim Checkin rev 1 2026-03-04
snort ET TROJAN TA450 CnC Victim Checkin rev 1 2026-03-04
snort ET TROJAN TA450 CnC Victim Checkin rev 1 2026-03-04
suricata ET MALWARE TA450 CnC Victim Checkin rev 1 2026-03-04
snort ET TROJAN TA450/MuddyWater CnC Victim Checkin rev 1 2026-02-20
snort ET TROJAN TA450/MuddyWater CnC Victim Checkin rev 1 2026-02-20
suricata ET MALWARE TA450/MuddyWater CnC Victim Checkin rev 1 2026-02-20
suricata ET MALWARE MoonRise CnC Commands Inbound via WebSocket rev 1 2026-02-20
suricata ET MALWARE TA450/MuddyWater CnC Victim Checkin rev 1 2026-02-20
snort ET TROJAN MoonRise CnC Commands Inbound via WebSocket rev 1 2026-02-20
elastic Deprecated - Potential Non-Standard Port HTTP/HTTPS connection deprecated 2026-02-04
suricata ET MALWARE Chrysalis Backdoor CnC Checkin rev 2 2026-02-03
snort ET TROJAN Chrysalis Backdoor CnC Checkin rev 2 2026-02-03
snort ET TROJAN MaskGramStealer CnC initial Victim Checkin rev 1 2026-01-08
suricata ET MALWARE MaskGramStealer CnC initial Victim Checkin rev 1 2026-01-08
snort ET TROJAN Lumma Stealer Victim Fingerprinting Activity rev 1 2026-01-06
suricata ET MALWARE Lumma Stealer Victim Fingerprinting Activity rev 1 2026-01-06
suricata ET MALWARE GachiLoader Staging HTTP Request rev 1 2025-12-23
snort ET TROJAN GachiLoader Staging HTTP Request rev 1 2025-12-23
sigma Github Self-Hosted Runner Execution test 2025-11-29
suricata ET MALWARE Phantom Captcha Fake Chrome User-Agent Observed rev 1 2025-10-23
snort ET TROJAN Phantom Captcha Fake Chrome User-Agent Observed rev 1 2025-10-23
snort ET TROJAN GlassWorm Decryption IV/Key Response rev 1 2025-10-20
suricata ET MALWARE GlassWorm Decryption IV/Key Response rev 1 2025-10-20
snort ET TROJAN Oyster Backdoor CnC Checkin M5 rev 1 2025-10-03
snort ET TROJAN Oyster Backdoor CnC Checkin M6 rev 1 2025-10-03
suricata ET MALWARE Oyster Backdoor CnC Checkin M5 rev 1 2025-10-03
suricata ET MALWARE Oyster Backdoor CnC Checkin M6 rev 1 2025-10-03
suricata ET MALWARE FrigidBackdoor Log Results rev 1 2025-09-18
snort ET TROJAN FrigidBackdoor Log Results rev 1 2025-09-18
snort ET TROJAN FrigidBackdoor Request ZIP rev 1 2025-09-18
snort ET TROJAN FrigidBackdoor Exfil Zip rev 1 2025-09-18
snort ET TROJAN FrigidBackdoor Health Check rev 1 2025-09-18
suricata ET MALWARE FrigidBackdoor Health Check rev 1 2025-09-18
suricata ET MALWARE FrigidBackdoor Exfil Zip rev 1 2025-09-18
suricata ET MALWARE FrigidBackdoor Request ZIP rev 1 2025-09-18
suricata ET MALWARE TA421/YTTRIUM/APT29 TLS Certificate M2 rev 3 2025-09-17
suricata ET MALWARE VampireBot CnC Config Inbound rev 1 2025-09-16
snort ET TROJAN VampireBot CnC Config Inbound rev 1 2025-09-16
snort ET TROJAN TinyNuke Checkin via Telegram rev 1 2025-09-10
snort ET TROJAN Lumma Stealer Victim Profile Exfil rev 1 2025-09-10
suricata ET MALWARE Lumma Stealer Victim Profile Exfil rev 1 2025-09-10
suricata ET MALWARE TinyNuke Checkin via Telegram rev 1 2025-09-10
suricata ET MALWARE TinyNuke Exfil User Profile via Telegram rev 1 2025-09-10
snort ET TROJAN TinyNuke Exfil User Profile via Telegram rev 1 2025-09-10
suricata ET MALWARE LimeRAT Exfiltrating RDP Credentials via Telegram rev 1 2025-09-09
snort ET TROJAN LimeRAT Exfiltrating RDP Credentials via Telegram rev 1 2025-09-09
snort ET TROJAN GCleaner Loader CnC Server Response rev 1 2025-09-02
suricata ET MALWARE GCleaner Loader CnC Server Response rev 1 2025-09-02
suricata ET MALWARE TA450 CnC Responding with Encryption Key/IV rev 1 2025-08-21
snort ET TROJAN TA450 CnC Responding with Encryption Key/IV rev 1 2025-08-21
snort ET TROJAN Observed Spoofed WindowsPowerShell User-Agent rev 1 2025-08-14
suricata ET MALWARE Observed Spoofed WindowsPowerShell User-Agent rev 1 2025-08-14
snort ET TROJAN CastleLoader User-Agent Observed rev 1 2025-08-13
suricata ET MALWARE CastleLoader User-Agent Observed rev 1 2025-08-13
suricata ET MALWARE TinyLoader CnC Response M1 rev 1 2025-08-07
suricata ET MALWARE TinyLoader CnC Response M2 rev 1 2025-08-07
snort ET TROJAN TinyLoader CnC Response M1 rev 1 2025-08-07
snort ET TROJAN TinyLoader CnC Response M2 rev 1 2025-08-07
snort ET TROJAN Kimsuky CnC AppKey Deletion Request rev 1 2025-07-31
snort ET TROJAN Kimsuky CnC AppKey Request rev 1 2025-07-31
suricata ET MALWARE Kimsuky CnC AppKey Deletion Request rev 1 2025-07-31
suricata ET MALWARE Kimsuky CnC AppKey Request rev 1 2025-07-31
snort ET TROJAN Raton TLS Server Certificate rev 1 2025-07-15
suricata ET MALWARE Raton TLS Server Certificate rev 1 2025-07-15
suricata ET MALWARE Voldemort System Info Exfil rev 1 2025-07-14
snort ET TROJAN Voldemort System Info Exfil rev 1 2025-07-14
snort ET TROJAN ShadowByte Botnet Framework New Zombie Checkin rev 1 2025-06-05
snort ET TROJAN ShadowByte Botnet FrameWork Zombie C2 Command Request rev 1 2025-06-05
suricata ET MALWARE ShadowByte Botnet Framework New Zombie Checkin rev 1 2025-06-05
suricata ET MALWARE ShadowByte Botnet FrameWork Zombie C2 Command Request rev 1 2025-06-05
snort ET TROJAN Gamaredon APT TryCloudFlare CnC Activity - Known Delimiter in User-Agent rev 1 2025-05-22
suricata ET MALWARE Gamaredon APT TryCloudFlare CnC Activity - Known Delimiter in User-Agent rev 1 2025-05-22
suricata ET MALWARE Interlock Ransomware Fake Updater CnC Callback rev 3 2025-05-19
snort ET TROJAN Interlock Ransomware Fake Updater CnC Callback rev 3 2025-05-16
snort ET TROJAN TerraStealerV2 New Victim Checkin via Telegram API rev 1 2025-05-02
snort ET TROJAN TerraStealerV2 CnC Telegram Bot Response rev 1 2025-05-02
suricata ET MALWARE TerraStealerV2 CnC Telegram Bot Response rev 1 2025-05-02
suricata ET MALWARE TerraStealerV2 New Victim Checkin via Telegram API rev 1 2025-05-02
suricata ET MALWARE TerraStealerV2 Data Exfil via WeTransfers rev 1 2025-05-02
snort ET TROJAN TerraStealerV2 Data Exfil via WeTransfers rev 1 2025-05-02
snort ET TROJAN Gremlin Stealer CnC Successful Exfil Confirmation rev 1 2025-04-29
suricata ET MALWARE Gremlin Stealer CnC Successful Exfil Confirmation rev 1 2025-04-29
snort ET TROJAN Gamaredon APT Style Delimiter Observed In HTTP User-Agent rev 1 2025-04-25
snort ET TROJAN Gamaredon APT Style Delimiter Observed In HTTP URI rev 1 2025-04-25
suricata ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP URI rev 1 2025-04-25
suricata ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP Cookie rev 1 2025-04-25
suricata ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP User-Agent rev 1 2025-04-25
snort ET INFO Gamaredon APT Style Delimiter Observed In HTTP Header rev 1 2025-04-25
suricata ET HUNTING Gamaredon APT Style Delimiter Observed In HTTP Header rev 1 2025-04-25
suricata ET MALWARE Interlock RAT CnC Checkin rev 1 2025-04-22
snort ET TROJAN Interlock RAT CnC Checkin rev 1 2025-04-22
suricata ET MALWARE UNK NSFWBot CnC Command Inbound rev 1 2025-04-21
snort ET TROJAN UNK NSFWBot C2 Additional Time Request rev 1 2025-04-21
suricata ET MALWARE UNK NSFWBot C2 Additional Time Request rev 1 2025-04-21
snort ET TROJAN UNK NSFWBot CnC Command Inbound rev 1 2025-04-21
snort ET TROJAN StealC v2 CnC Server Response rev 1 2025-04-11
suricata ET MALWARE StealC v2 CnC Server Response rev 1 2025-04-11
snort ET TROJAN Amadey CnC Response rev 1 2025-03-20
suricata ET MALWARE Amadey CnC Response rev 1 2025-03-20
suricata ET MALWARE TINYSHELL impad Variant Encrypted Auth Token rev 1 2025-03-14
snort ET TROJAN TINYSHELL impad Variant Encrypted Auth Token rev 1 2025-03-14
suricata ET MALWARE TINYSHELL impad Variant Command Packet rev 1 2025-03-14
snort ET TROJAN TINYSHELL impad Variant Command Packet rev 1 2025-03-14
suricata ET MALWARE Observed POST to ClickFix Style URI M1 rev 1 2025-03-07
snort ET TROJAN Observed GET to ClickFix Style URI M1 rev 1 2025-03-07
snort ET TROJAN Observed POST to ClickFix Style URI M1 rev 1 2025-03-07
suricata ET MALWARE Observed GET to ClickFix Style URI M1 rev 1 2025-03-07
snort ET TROJAN OtterCookie Victim Command Execution Confirmation To CnC Server rev 1 2025-03-05
suricata ET MALWARE OtterCookie Payload Request rev 1 2025-03-05
snort ET TROJAN OtterCookie Payload Request rev 1 2025-03-05
snort ET TROJAN OtterCookie Host Profile Exfil rev 1 2025-03-05
suricata ET MALWARE OtterCookie Host Profile Exfil rev 1 2025-03-05
suricata ET MALWARE OtterCookie Victim Command Execution Confirmation To CnC Server rev 1 2025-03-05
suricata ET MALWARE Winos4.0 Framework Fake BMP Download Containing XOR encoded .dll rev 1 2025-02-07
snort ET TROJAN Nosviak C2 Variant Advertised Services in HTML Elements rev 1 2025-01-27
suricata ET MALWARE Nosviak C2 Variant Advertised Services in HTML Elements rev 1 2025-01-27
suricata ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 rev 1 2025-01-17
snort ET TROJAN Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 rev 1 2025-01-17
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows Server 2012 R2/Windows 8.1 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows 11 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] Gootloader C2 Activity - Windows Server 2016 - barefootinc.com[.]au rev 1 2024-12-15
suricata ET MALWARE [CIS] GootLoader C2 Activity - Windows 10/Server 2019/2022 - barefootinc.com[.]au rev 1 2024-12-15
sigma GALLIUM IOCs test 2024-11-23
suricata ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram rev 1 2024-11-21
snort ET TROJAN Snake/Best Private Keylogger CnC Exfil Via Telegram rev 1 2024-11-21
suricata ET MALWARE Malicious CobaltStrike SSL/TLS Certificate Observed rev 1 2024-09-05
snort ET TROJAN Malicious CobaltStrike SSL/TLS Certificate Observed rev 1 2024-09-05
suricata ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected rev 5 2024-09-04
snort ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected rev 4 2024-09-04
suricata ET MALWARE BlankGrabber Stealer Exfiltration via Discord rev 1 2024-08-22
snort ET TROJAN BlankGrabber Stealer Exfiltration via Discord rev 1 2024-08-22
sigma Potentially Suspicious Rundll32.EXE Execution of UDL File test 2024-08-16
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET CURRENT_EVENTS TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET MALWARE UTA0178 Domain in TLS SNI rev 4 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
suricata ET PHISHING TA427/Kimsuky Domain in TLS SNI rev 1 2024-08-09
snort ET TROJAN Lumma Stealer CnC Host Checkin rev 1 2024-07-23
suricata ET MALWARE Lumma Stealer CnC Host Checkin rev 1 2024-07-23
suricata ET MALWARE Mythic Framework SSL/TLS Certificate Observed rev 1 2024-07-22
suricata ET MALWARE Win32/saolei CnC Host Checkin rev 1 2024-07-19
snort ET TROJAN Win32/saolei CnC Host Checkin rev 1 2024-07-19
snort ET TROJAN ZharkBot User-Agent Observed rev 1 2024-07-09
suricata ET MALWARE ZharkBot CnC Exfil in HTTP URI rev 1 2024-07-09
suricata ET MALWARE ZharkBot User-Agent Observed rev 1 2024-07-09
snort ET TROJAN ZharkBot CnC Exfil in HTTP URI rev 1 2024-07-09
snort ET TROJAN Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
snort ET TROJAN Observed ZLoader CnC Domain in SNI rev 2 2024-07-04
suricata ET MALWARE TA421/YTTRIUM/APT29 TLS Certificate M3 rev 3 2024-07-04
suricata ET MALWARE Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
suricata ET MALWARE Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
suricata ET MALWARE Observed ZLoader CnC Domain in SNI rev 3 2024-07-04
suricata ET MALWARE Observed ZLoader CnC Domain in SNI rev 3 2024-07-04
snort ET TROJAN Observed ZLoader CnC Domain in SNI rev 2 2024-07-04
snort ET TROJAN Suspected UTA0178 Domain in TLS SNI rev 2 2024-07-04
suricata ET MALWARE SilentCryptoMiner Agent Config Inbound rev 1 2024-07-03
snort ET TROJAN SilentCryptoMiner Agent Config Inbound rev 1 2024-07-03
suricata ET MALWARE Suspected Powershell Empire Activity M2 rev 1 2024-06-20
suricata ET MALWARE Suspected Powershell Empire Activity M3 rev 1 2024-06-20
snort ET TROJAN Suspected Powershell Empire Activity M1 rev 1 2024-06-20
snort ET TROJAN Suspected Powershell Empire Activity M2 rev 1 2024-06-20
snort ET TROJAN Suspected Powershell Empire Activity M3 rev 1 2024-06-20
suricata ET MALWARE Suspected Powershell Empire Activity M1 rev 1 2024-06-20
suricata ET MALWARE ClearFake User-Agent Observed rev 1 2024-06-10
snort ET TROJAN x64/Generic Red Team Activity CnC Response rev 1 2024-05-21
suricata ET MALWARE x64/Generic Red Team Activity CnC Response rev 1 2024-05-21
snort ET TROJAN Horabot CnC Host Details Exfil rev 1 2024-05-16
suricata ET MALWARE Horabot CnC Host Details Exfil rev 1 2024-05-16
suricata ET MALWARE AutoIt3 Script Downloaded via Powershell Shortly After AutoIt3.exe Download rev 1 2024-05-09
suricata ET MALWARE DarkGate CnC Exfil via AutoIt Payload rev 1 2024-05-09
snort ET TROJAN AutoIt3.exe Downloaded via Powershell rev 1 2024-05-09
snort ET TROJAN AutoIt3 Script Downloaded via Powershell Shortly After AutoIt3.exe Download rev 1 2024-05-09
snort ET TROJAN DarkGate CnC Exfil via AutoIt Payload rev 1 2024-05-09
suricata ET MALWARE AutoIt3.exe Downloaded via Powershell rev 1 2024-05-09
snort ET TROJAN Observed TA453 Related Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN Observed TA453 Domain in TLS SNI rev 1 2024-05-06
suricata ET MALWARE Observed TA453 Related Domain in TLS SNI rev 1 2024-05-06
suricata ET MALWARE Observed TA453 Domain in TLS SNI rev 1 2024-05-06
suricata ET MALWARE Observed TA453 Domain in TLS SNI rev 1 2024-05-06
snort ET TROJAN Observed TA453 Domain in TLS SNI rev 1 2024-05-06
suricata ET MALWARE 000Stealer Data Exfiltration M1 rev 3 2024-04-26
suricata ET MALWARE VectorStealer Data Exfil via Telegram rev 2 2024-04-26
suricata ET MALWARE Likely Malicious SSL Cert With Script Tags rev 4 2024-04-25
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE Observed AridViper CnC Domain in TLS SNI rev 3 2024-04-13
suricata ET MALWARE CommentCrew Possible APT c2 communications get command client key rev 6 2024-04-07
suricata ET MALWARE TA421 Wineloader CnC Checkin M4 rev 3 2024-04-03
suricata ET MALWARE TA421 Wineloader CnC Checkin M3 rev 3 2024-04-03
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-27
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-27
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-27
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-27
suricata ET MALWARE [DCSO] Andariel Exfil Activity rev 2 2024-03-27
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-27
suricata ET MALWARE CopperStealer - Remote Desktop - Initial Checkin rev 2 2024-03-26
suricata ET MALWARE Win32/TrojanDownloader.Agent.RFS Variant Checkin rev 2 2024-03-26
suricata ET MALWARE AHK Bot Domain Profiler CnC Activity rev 2 2024-03-26
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Win32.Raccoon Stealer CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed MageCart CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed Reimageplus Ransomware Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed Unk.PowerShell Loader CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed TaurusStealer CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 3 2024-03-25
suricata ET MALWARE Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI rev 2 2024-03-25
suricata ET MALWARE Observed CobInt CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed CobInt CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Upatre CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Ursnif Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Ursnif Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed GoBotKR Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Glupteba CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE ASNAROK Related Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE ASNAROK Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed VikroStealer CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed VikroStealer CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed IcedID CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed DCRat CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed APT/SideWinder CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Get2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE Observed Get2 CnC Domain in TLS SNI rev 2 2024-03-24
suricata ET MALWARE CommentCrew Possible APT c2 communications download client.png rev 5 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep rev 4 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep2 rev 4 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep3 rev 5 2024-03-13
suricata ET MALWARE CommentCrew Possible APT c2 communications sleep5 rev 5 2024-03-13
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 2 2024-03-07
snort ET TROJAN Splinter Red Team Tool Activity rev 1 2024-03-07
suricata ET MALWARE Splinter Red Team Tool Activity rev 1 2024-03-07
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 2 2024-03-07
suricata ET MALWARE Observed StrongPity CnC Domain in TLS SNI rev 2 2024-03-07
snort ET TROJAN Suspected TA430/Andariel AndarLoader Related Domain in TLS SNI rev 1 2024-02-28
suricata ET MALWARE Suspected TA430/Andariel AndarLoader Related Domain in TLS SNI rev 1 2024-02-28
suricata ET MALWARE Observed Lactrodectus Domain in TLS SNI rev 1 2024-02-26
suricata ET MALWARE Observed Lactrodectus Domain in TLS SNI rev 1 2024-02-26
suricata ET MALWARE TinyTurlaNG Turla APT GetTask Request rev 1 2024-02-16
snort ET TROJAN TinyTurlaNG Turla APT GetTask Request rev 1 2024-02-16
snort ET TROJAN TinyTurlaNG Turla APT Initial Client Beacon rev 1 2024-02-16
suricata ET MALWARE TinyTurlaNG Turla APT Initial Client Beacon rev 1 2024-02-16
suricata ET MALWARE Observed TA402 Domain in TLS SNI rev 1 2023-11-13
snort ET TROJAN Observed TA402 Domain in TLS SNI rev 1 2023-11-13
suricata ET MALWARE Observed TA402 Domain in TLS SNI rev 1 2023-11-13
elastic Deprecated - Potential Reverse Shell via Suspicious Parent Process deprecated 2023-11-02
suricata ET MALWARE Observed TA406 Related Domain in TLS SNI rev 1 2023-09-12
snort ET TROJAN Observed TA406 Related Domain in TLS SNI rev 1 2023-09-12
suricata ET MALWARE Observed TA444 Domain in TLS SNI rev 1 2023-08-24
suricata ET MALWARE Observed TA444 Domain in TLS SNI rev 1 2023-08-24
suricata ET MALWARE Observed TA401 Related Domain in TLS SNI rev 1 2023-08-09
snort ET TROJAN [DCSO] Andariel Exfil Activity rev 1 2023-06-05
suricata ET MALWARE [DCSO] Possible Andariel Exfil Activity rev 1 2023-06-05
snort ET TROJAN [DCSO] Possible Andariel Exfil Activity rev 1 2023-06-05
snort ET TROJAN VectorStealer Data Exfil via Telegram rev 2 2023-04-07
snort ET TROJAN SoulSearcher Checkin M1 rev 4 2023-04-04
snort ET TROJAN CopperStealer - Remote Desktop - Initial Checkin rev 2 2023-04-04
snort ET TROJAN SoulSearcher Checkin M2 rev 4 2023-04-04
sigma Suspicious Installer Package Child Process test 2023-02-18
sigma HackTool - SILENTTRINITY Stager DLL Load test 2023-02-17
suricata ET MALWARE OSX/iWebUpdate CnC Activity rev 1 2023-02-15
snort ET TROJAN OSX/iWebUpdate CnC Activity rev 1 2023-02-15
sigma HackTool - SILENTTRINITY Stager Execution test 2023-02-13
snort ET TROJAN AHK Bot Domain Profiler CnC Activity rev 1 2023-01-05
sigma GALLIUM Artefacts - Builtin test 2023-01-02
snort ET TROJAN CopperStealer - Remote Desktop - CnC Server Response via Pastebin rev 1 2022-06-17
suricata ET MALWARE CopperStealer - Remote Desktop - CnC Server Request via Pastebin rev 1 2022-06-17
suricata ET MALWARE CopperStealer - Remote Desktop - Task Request rev 1 2022-06-17
snort ET TROJAN CopperStealer - Remote Desktop - Task Request rev 1 2022-06-17
suricata ET MALWARE CopperStealer - Remote Desktop - CnC Server Response via Pastebin rev 1 2022-06-17
snort ET TROJAN CopperStealer - Remote Desktop - CnC Server Request via Pastebin rev 1 2022-06-17
suricata ET MALWARE Win32/SVCReady Loader - SysInfo M2 rev 1 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader - Screenshot rev 1 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - Screenshot rev 1 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - SysInfo M2 rev 1 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - SysInfo M1 rev 1 2022-05-12
snort ET TROJAN Win32/SVCReady Loader - Logs rev 1 2022-05-12
snort ET TROJAN Win32/SVCReady Loader CnC Activity M2 rev 2 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader CnC Activity M2 rev 2 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader - Logs rev 1 2022-05-12
suricata ET MALWARE Win32/SVCReady Loader - SysInfo M1 rev 1 2022-05-12
snort ET TROJAN PoshC2 - Observed Default URI Structure M23 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M32 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M31 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M30 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M29 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M28 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M27 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M26 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M25 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M24 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M22 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M21 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M20 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M19 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M18 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M17 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M16 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M15 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M13 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M12 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M11 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M10 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M9 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M8 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M7 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M6 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M5 rev 2 2022-05-06
snort ET TROJAN PoshC2 - Observed Default URI Structure M2 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M32 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M31 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M30 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M29 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M28 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M27 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M26 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M25 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M24 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M23 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M22 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M21 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M20 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M19 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M18 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M17 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M16 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M15 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M13 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M12 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M11 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M10 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M9 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M8 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M7 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M6 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M5 rev 2 2022-05-06
suricata ET MALWARE PoshC2 - Observed Default URI Structure M2 rev 2 2022-05-06
snort ET TROJAN 000Stealer Data Exfiltration M1 rev 2 2022-04-22
snort ET TROJAN Win32/TrojanDownloader.Agent.RFS Variant Checkin rev 2 2022-04-20
suricata ET MALWARE SoulSearcher Checkin M1 rev 2 2022-03-09
suricata ET MALWARE SoulSearcher Checkin M2 rev 2 2022-03-09
snort ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2021-09-10
snort ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2021-09-10
snort ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2021-09-10
snort ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2021-09-10
snort ET TROJAN Observed ELF/HabitsRAT CnC Domain in TLS SNI rev 2 2021-09-10
snort ET TROJAN TA421/YTTRIUM/APT29 TLS Certificate M2 rev 2 2021-07-31
snort ET TROJAN TA421/YTTRIUM/APT29 TLS Certificate M3 rev 1 2021-07-31
suricata ET MALWARE Anchor_DNS stickseed Variant CnC Checkin rev 2 2021-07-26
snort ET TROJAN Anchor_DNS stickseed Variant CnC Checkin rev 2 2021-07-26
snort ET TROJAN Win32.Raccoon Stealer CnC Domain in TLS SNI rev 2 2021-03-03
snort ET TROJAN Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2021-02-22
snort ET TROJAN Observed OSX/Silver Sparrow Download Domain in TLS SNI rev 2 2021-02-22
snort ET TROJAN Observed DarkSide Ransomware CnC Domain in TLS SNI rev 2 2020-12-29
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
snort ET TROJAN Observed AridViper CnC Domain in TLS SNI rev 2 2020-12-16
suricata ET MALWARE Observed Magecart CnC Domain in TLS SNI rev 2 2020-10-26
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-10-14
suricata ET MALWARE Observed Card Skimmer CnC Domain in TLS SNI rev 1 2020-10-06
snort ET TROJAN Observed Reimageplus Ransomware Domain in TLS SNI rev 2 2020-09-11
snort ET TROJAN Observed MageCart CnC Domain in TLS SNI rev 2 2020-09-02
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-09-02
snort ET TROJAN Observed Get2 CnC Domain in TLS SNI rev 2 2020-08-26
snort ET TROJAN Observed Get2 CnC Domain in TLS SNI rev 2 2020-08-26
snort ET TROJAN Observed APT/SideWinder CnC Domain in TLS SNI rev 2 2020-08-24
snort ET TROJAN Observed DCRat CnC Domain in TLS SNI rev 2 2020-08-10
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-21
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-20
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-20
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-20
snort ET TROJAN Observed IcedID CnC Domain in TLS SNI rev 2 2020-07-20
snort ET TROJAN Observed TaurusStealer CnC Domain in TLS SNI rev 2 2020-07-07
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed CobaltStrike CnC Domain in TLS SNI rev 2 2020-07-03
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed StrongPity CnC Domain in TLS SNI rev 2 2020-07-01
snort ET TROJAN Observed VikroStealer CnC Domain in TLS SNI rev 2 2020-06-23
snort ET TROJAN Observed VikroStealer CnC Domain in TLS SNI rev 2 2020-06-22
snort ET TROJAN ASNAROK Domain in TLS SNI rev 2 2020-04-27
snort ET TROJAN ASNAROK Related Domain in TLS SNI rev 2 2020-04-27
snort ET TROJAN Observed Glupteba CnC Domain in TLS SNI rev 2 2020-03-30
snort ET TROJAN Observed GoBotKR Domain in TLS SNI rev 2 2020-03-03
snort ET TROJAN Observed GoBotKR Domain in TLS SNI rev 2 2020-03-03
snort ET TROJAN Observed GoBotKR Domain in TLS SNI rev 2 2020-03-03
snort ET TROJAN Observed GoBotKR Domain in TLS SNI rev 2 2020-03-03
snort ET TROJAN Observed GoBotKR Domain in TLS SNI rev 2 2020-03-03
snort ET TROJAN Observed Ursnif Domain in TLS SNI rev 2 2020-02-27
snort ET TROJAN Observed Ursnif Domain in TLS SNI rev 2 2020-02-27
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed PHPs Labyrinth Stage2 CnC Domain in TLS SNI rev 2 2020-02-20
snort ET TROJAN Observed Unk.PowerShell Loader CnC Domain in TLS SNI rev 2 2020-01-29
snort ET TROJAN Observed Magecart CnC Domain in TLS SNI rev 2 2020-01-22
suricata ET MALWARE Observed Magecart CnC Domain in TLS SNI rev 1 2020-01-22
suricata ET MALWARE Observed Magecart CnC Domain in TLS SNI rev 1 2020-01-22
snort ET TROJAN Observed Magecart CnC Domain in TLS SNI rev 2 2020-01-22
suricata ET MALWARE Observed Magecart CnC Domain in TLS SNI rev 1 2020-01-06
snort ET TROJAN Observed Magecart CnC Domain in TLS SNI rev 2 2020-01-06
snort ET TROJAN Observed Magecart CnC Domain in TLS SNI rev 2 2020-01-06
suricata ET MALWARE Observed Magecart CnC Domain in TLS SNI rev 1 2020-01-06
snort ET TROJAN Observed Magecart CnC Domain in TLS SNI rev 2 2019-12-30
snort ET TROJAN Observed Upatre CnC Domain in TLS SNI rev 2 2019-12-27
snort ET TROJAN Observed CobInt CnC Domain in TLS SNI rev 2 2019-11-15
snort ET TROJAN Observed CobInt CnC Domain in TLS SNI rev 2 2019-11-15
suricata ET MALWARE CommentCrew Possible APT c2 communications get system rev 4 2019-07-26
suricata ET MALWARE CommentCrew Possible APT c2 communications html return 1 rev 3 2019-07-26
snort ET TROJAN CommentCrew Possible APT c2 communications sleep rev 2 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications get system rev 4 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications get command client key rev 5 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications download client.png rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications sleep5 rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications sleep3 rev 3 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications sleep2 rev 2 2014-09-19
snort ET TROJAN CommentCrew Possible APT c2 communications html return 1 rev 3 2014-09-19
snort ET TROJAN Likely Malicious SSL Cert With Script Tags rev 1 2014-07-24
sentinel Mercury - Domain, Hash and IP IOCs - August 2022 Scheduled —
sentinel Risky user signin observed in non-Microsoft network device Scheduled —
sentinel Fortinet - Beacon pattern detected Scheduled —
sentinel Malformed user agent Scheduled —
sentinel Known Forest Blizzard group domains - July 2019 Scheduled —
sentinel Europium - Hash and IP IOCs - September 2022 Scheduled —