| elastic |
Connection to Commonly Abused Web Services |
production |
2026-10-19 |
| splunk |
Windows Ngrok Reverse Proxy Usage |
production |
2026-10-09 |
| elastic |
Connection to Common Large Language Model Endpoints |
production |
2026-10-09 |
| elastic |
Network Connection to OAST Domain via Script Interpreter |
production |
2026-09-23 |
| elastic |
Suspicious File Downloaded from Google Drive |
production |
2026-09-18 |
| elastic |
Uncommon DNS Request via Bun or Node.js |
production |
2026-09-18 |
| elastic |
AWS SNS Topic Message Publish by Rare User |
production |
2026-09-18 |
| elastic |
Unusual Web Request |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential EtherHiding C2 via Curl JSON-RPC Request |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity with High Confidence |
production |
2026-09-18 |
| elastic |
AWS SNS Rare Protocol Subscription by User |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity |
production |
2026-09-18 |
| elastic |
Unusual DNS Request to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Linux Telegram API Request |
production |
2026-09-18 |
| elastic |
AWS CLI Command with Custom Endpoint URL |
production |
2026-09-18 |
| splunk |
Windows Abused Web Services |
production |
2026-05-13 |
| splunk |
Ngrok Reverse Proxy on Network |
production |
2026-05-13 |
| splunk |
Linux Ngrok Reverse Proxy Usage |
production |
2026-05-13 |
| sigma |
New Connection Initiated To Potential Dead Drop Resolver Domain |
test |
2026-03-29 |
| snort |
ET INFO Moltbook skill.md request |
rev 1 |
2026-02-02 |
| suricata |
ET INFO Moltbook AI Agent Registration Attempt |
rev 1 |
2026-02-02 |
| suricata |
ET INFO Moltbook skill.md request |
rev 1 |
2026-02-02 |
| suricata |
ET INFO Moltbook messaging.md request |
rev 1 |
2026-02-02 |
| suricata |
ET INFO Moltbook heartbeat.md request |
rev 1 |
2026-02-02 |
| suricata |
ET INFO Moltbook skill.json request |
rev 1 |
2026-02-02 |
| snort |
ET INFO Moltbook AI Agent Registration Attempt |
rev 1 |
2026-02-02 |
| snort |
ET INFO Moltbook messaging.md request |
rev 1 |
2026-02-02 |
| snort |
ET INFO Moltbook heartbeat.md request |
rev 1 |
2026-02-02 |
| snort |
ET INFO Moltbook skill.json request |
rev 1 |
2026-02-02 |
| snort |
ET TROJAN GhostRedirector Rungan Backdoor Access M4 |
rev 1 |
2025-09-05 |
| suricata |
ET MALWARE GhostRedirector Rungan Backdoor Access M1 |
rev 1 |
2025-09-05 |
| suricata |
ET MALWARE GhostRedirector Rungan Backdoor Access M2 |
rev 1 |
2025-09-05 |
| snort |
ET TROJAN GhostRedirector Rungan Backdoor Access M1 |
rev 1 |
2025-09-05 |
| snort |
ET TROJAN GhostRedirector Rungan Backdoor Access M2 |
rev 1 |
2025-09-05 |
| suricata |
ET MALWARE GhostRedirector Rungan Backdoor Access M4 |
rev 1 |
2025-09-05 |
| snort |
ET TROJAN GhostRedirector Rungan Backdoor Access M3 |
rev 1 |
2025-09-05 |
| suricata |
ET MALWARE GhostRedirector Rungan Backdoor Access M3 |
rev 1 |
2025-09-05 |
| sigma |
Process Initiated Network Connection To Ngrok Domain |
test |
2025-07-30 |
| snort |
ET TROJAN KimJongRAT CnC Checkin |
rev 1 |
2025-06-24 |
| suricata |
ET MALWARE KimJongRAT CnC Checkin |
rev 1 |
2025-06-24 |
| snort |
ET INFO Dotted Quad Host Workzueg HTTP Server String Response |
rev 1 |
2025-06-16 |
| suricata |
ET HUNTING Dotted Quad Host Workzueg HTTP Server String Response |
rev 1 |
2025-06-16 |
| sigma |
Suspicious Non-Browser Network Communication With Google API |
experimental |
2025-02-22 |
| sigma |
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process |
test |
2024-07-16 |
| sigma |
Communication To LocaltoNet Tunneling Service Initiated - Linux |
test |
2024-06-17 |
| sigma |
Communication To LocaltoNet Tunneling Service Initiated |
test |
2024-06-17 |
| sigma |
Communication To Ngrok Tunneling Service Initiated |
test |
2024-02-02 |
| sigma |
Cloudflared Tunnel Connections Cleanup |
test |
2023-12-21 |
| sigma |
Cloudflared Tunnel Execution |
test |
2023-12-20 |
| sigma |
Suspicious Child Process Of Manage Engine ServiceDesk |
test |
2023-08-29 |
| sigma |
Suspicious Non-Browser Network Communication With Telegram API |
test |
2023-05-19 |
| sigma |
Potentially Suspicious Network Connection To Notion API |
test |
2023-05-03 |
| sigma |
Communication To Ngrok Tunneling Service - Linux |
test |
2022-11-03 |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |