| elastic |
Potential RMM Execution from a Commonly Abused Web Service |
production |
2026-10-22 |
| elastic |
AWS EKS Pod Exec with Curl or Wget to HTTPS |
production |
2026-10-20 |
| elastic |
Suspicious Windows Powershell Arguments |
production |
2026-10-19 |
| sigma |
Legitimate Application Writing Files In Uncommon Location |
experimental |
2026-10-14 |
| splunk |
PowerShell Download from Code Hosting Service |
production |
2026-10-13 |
| splunk |
Windows Cabinet File Extraction Via Expand |
production |
2026-10-09 |
| splunk |
Windows File Download Via CertUtil |
production |
2026-10-09 |
| splunk |
Windows Curl Upload to Remote Destination |
production |
2026-10-09 |
| elastic |
Suspicious Windows Command Shell Arguments |
production |
2026-10-09 |
| splunk |
Windows SSH Proxy Command |
production |
2026-10-09 |
| splunk |
Linux Ingress Tool Transfer Hunting |
production |
2026-10-09 |
| splunk |
Linux Ingress Tool Transfer with Curl |
production |
2026-10-09 |
| splunk |
Cisco Secure Firewall - Communication Over Suspicious Ports |
production |
2026-10-08 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-10-08 |
| splunk |
Cisco Secure Firewall - Connection to File Sharing Domain |
production |
2026-10-08 |
| elastic |
Remote File Download via Script Interpreter |
production |
2026-10-08 |
| elastic |
ELF Payload Staged in a Suspicious Directory |
production |
2026-10-07 |
| splunk |
Download Files Using Telegram |
production |
2026-10-06 |
| elastic |
Roshal Archive (RAR) or PowerShell File Downloaded from the Internet |
production |
2026-10-06 |
| splunk |
Windows DNS Query Request To TinyUrl |
production |
2026-10-06 |
| elastic |
Curl Execution via Shell Profile |
production |
2026-10-05 |
| elastic |
Potential ClickFix Command via Windows Run Dialog |
production |
2026-10-05 |
| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-10-05 |
| splunk |
Windows File Download Via PowerShell |
production |
2026-10-02 |
| splunk |
Windows Ldifde Directory Object Behavior |
production |
2026-10-02 |
| splunk |
Linux Curl Upload File |
production |
2026-10-02 |
| splunk |
Cisco Isovalent - Curl Execution With Insecure Flags |
production |
2026-10-02 |
| splunk |
BITSAdmin Download File |
production |
2026-10-02 |
| splunk |
Windows Curl Download to Suspicious Path |
production |
2026-10-02 |
| elastic |
ESXi Curl or Wget Activity |
production |
2026-09-30 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M4 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN Generic PowerShell Loader Inbound |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE Generic PowerShell Loader Inbound |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M3 |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M4 |
rev 1 |
2026-09-29 |
| suricata |
ET MALWARE ReverseLoader Base64 Encoded Executable Inbound M5 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M5 |
rev 1 |
2026-09-29 |
| snort |
ET TROJAN ReverseLoader Base64 Encoded Executable Inbound M3 |
rev 1 |
2026-09-29 |
| elastic |
LLM-Based Curl Activity Triage via Auditd |
production |
2026-09-25 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| elastic |
LLM-Based Wget Activity Triage |
production |
2026-09-25 |
| elastic |
LLM-Based Wget Activity Triage via Auditd |
production |
2026-09-25 |
| elastic |
LLM-Based Curl Activity Triage |
production |
2026-09-25 |
| snort |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound M3 |
rev 1 |
2026-09-24 |
| suricata |
ET MALWARE Portuguese JS Dropper Payload Request |
rev 1 |
2026-09-24 |
| suricata |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound M3 |
rev 1 |
2026-09-24 |
| snort |
ET TROJAN Portuguese JS Dropper Payload Request |
rev 1 |
2026-09-24 |
| elastic |
Curl Download Activity from npm Package Install |
production |
2026-09-23 |
| elastic |
Suspicious PowerShell from npm Package Install |
production |
2026-09-22 |
| splunk |
Cisco NVM - Webserver Download From File Sharing Website |
production |
2026-09-22 |
| splunk |
Cisco NVM - Suspicious File Download via Headless Browser |
production |
2026-09-22 |
| splunk |
Cisco Secure Firewall - Repeated Malware Downloads |
production |
2026-09-22 |
| splunk |
Cisco Secure Firewall - Malware File Downloaded |
production |
2026-09-22 |
| elastic |
Kubernetes Pod Exec with Curl or Wget to HTTPS |
production |
2026-09-22 |
| splunk |
Cisco Secure Firewall - File Download Over Uncommon Port |
production |
2026-09-22 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Potential Remote File Execution via MSIEXEC |
production |
2026-09-18 |
| elastic |
Suspicious Execution from INET Cache |
production |
2026-09-18 |
| elastic |
Suspicious JavaScript Execution via Deno |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
Java Dropped and Executed With DNS Lookup |
production |
2026-09-18 |
| elastic |
Suspicious Command Prompt Network Connection |
production |
2026-09-18 |
| elastic |
Suspicious CertUtil Commands |
production |
2026-09-18 |
| elastic |
Network Connection via MsXsl |
production |
2026-09-18 |
| elastic |
Potential Remote Install via MsiExec |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Curl for Windows |
production |
2026-09-18 |
| elastic |
Remote File Copy via TeamViewer |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
RMM Software Installation from an Internet-Originated MSI |
production |
2026-09-18 |
| elastic |
RMM Software Installation from a Commonly Abused Web Service |
production |
2026-09-18 |
| elastic |
Remote File Download via PowerShell |
production |
2026-09-18 |
| elastic |
Remote File Download via MpCmdRun |
production |
2026-09-18 |
| elastic |
Remote File Download via Desktopimgdownldr Utility |
production |
2026-09-18 |
| elastic |
Ingress Transfer via Windows BITS |
production |
2026-09-18 |
| elastic |
Potential File Download via a Headless Browser |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Certreq |
production |
2026-09-18 |
| elastic |
Network Traffic to Rare Destination Country |
production |
2026-09-18 |
| suricata |
ET MALWARE AsyncRAT Powershell Payload |
rev 1 |
2026-09-18 |
| elastic |
Unusual Network Destination Domain Name |
production |
2026-09-18 |
| elastic |
Apple Script Execution followed by Network Connection |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Suspicious Browser Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
Suspicious Curl from macOS Application |
production |
2026-09-18 |
| elastic |
Executable File Download via Wget |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Source Download |
production |
2026-09-18 |
| elastic |
Unusual Remote File Creation |
production |
2026-09-18 |
| elastic |
Potential THC Tool Downloaded |
production |
2026-09-18 |
| elastic |
Remote File Creation in World Writeable Directory |
production |
2026-09-18 |
| elastic |
Curl or Wget Spawned via Node.js |
production |
2026-09-18 |
| elastic |
Suspicious File Downloaded from Google Drive |
production |
2026-09-18 |
| snort |
ET TROJAN AsyncRAT Powershell Payload |
rev 1 |
2026-09-18 |
| elastic |
AWS EC2 LOLBin Execution via SSM SendCommand |
production |
2026-09-18 |
| elastic |
Potential Git CVE-2025-48384 Exploitation |
production |
2026-09-18 |
| elastic |
Initial Access via File Upload Followed by GET Request |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
File Download Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launch Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
System Path File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Payload Execution via Shell Pipe Detected by Defend for Containers |
production |
2026-09-18 |
| elastic |
Tool Installation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
GKE Pod Exec with Curl or Wget to HTTPS |
production |
2026-09-18 |
| elastic |
Curl or Wget Execution from Container Context |
production |
2026-09-18 |
| elastic |
Git Repository or File Download to Suspicious Directory |
production |
2026-09-18 |
| elastic |
Curl or Wget Egress Network Connection via LoLBin |
production |
2026-09-18 |
| elastic |
Potentially Suspicious Process Started via tmux or screen |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launched Inside A Container |
production |
2026-09-18 |
| snort |
ET TROJAN AMOS ClickFix Campaign - Bash Stager M1 |
rev 1 |
2026-09-17 |
| suricata |
ET MALWARE AMOS ClickFix Campaign - Bash Stager M1 |
rev 1 |
2026-09-17 |
| splunk |
Windows Process Accessing IronLanguages Repository On GitHub |
production |
2026-09-16 |
| snort |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound M2 |
rev 1 |
2026-09-04 |
| suricata |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound M2 |
rev 1 |
2026-09-04 |
| snort |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound |
rev 1 |
2026-09-03 |
| suricata |
ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound |
rev 1 |
2026-09-03 |
| splunk |
File Download or Read to Pipe Execution |
production |
2026-09-01 |
| suricata |
ET ATTACK_RESPONSE Grizzly Loader PowerShell Script Inbound |
rev 1 |
2026-08-31 |
| snort |
ET ATTACK_RESPONSE Grizzly Loader PowerShell Script Inbound |
rev 1 |
2026-08-31 |
| splunk |
LOLBAS Rare Network Connection |
production |
2026-08-24 |
| splunk |
LOLBAS Network Connection On Uncommon Port |
production |
2026-08-24 |
| splunk |
Windows Suspicious Defender Update Activity in INetCache |
production |
2026-07-20 |
| snort |
ET TROJAN Observed Fake Updates Page Inbound |
rev 1 |
2026-06-05 |
| suricata |
ET MALWARE Observed Fake Updates Page Inbound |
rev 1 |
2026-06-05 |
| suricata |
ET ATTACK_RESPONSE MacSync Stealer Payload Inbound |
rev 1 |
2026-05-27 |
| suricata |
ET ATTACK_RESPONSE MacSync Stealer Stage 2 Payload Inbound |
rev 1 |
2026-05-27 |
| snort |
ET ATTACK_RESPONSE MacSync Stealer Stage 2 Payload Inbound |
rev 1 |
2026-05-27 |
| snort |
ET ATTACK_RESPONSE MacSync Stealer Payload Inbound |
rev 1 |
2026-05-27 |
| snort |
ET ATTACK_RESPONSE RMM Payload Delivery Page Observed |
rev 1 |
2026-05-18 |
| snort |
ET ATTACK_RESPONSE ScreenConnect RMM Payload Delivered via Fake Docusign Page |
rev 1 |
2026-05-18 |
| suricata |
ET ATTACK_RESPONSE RMM Payload Delivery Page Observed |
rev 1 |
2026-05-18 |
| suricata |
ET ATTACK_RESPONSE ScreenConnect RMM Payload Delivered via Fake Docusign Page |
rev 1 |
2026-05-18 |
| snort |
ET ATTACK_RESPONSE EtherHiding Payload Delivery Script Observed Inbound |
rev 1 |
2026-05-13 |
| splunk |
Juniper Networks Remote Code Execution Exploit Detection |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Wget or Curl Download |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High EVE Threat Confidence |
production |
2026-05-13 |
| splunk |
WinRAR Spawning Shell Application |
production |
2026-05-13 |
| splunk |
Windows SQL Spawning CertUtil |
experimental |
2026-05-13 |
| splunk |
Windows Process Execution From RDP Share |
production |
2026-05-13 |
| splunk |
Windows Ingress Tool Transfer Using Explorer |
production |
2026-05-13 |
| splunk |
Windows DLL Module Loaded in Temp Dir |
production |
2026-05-13 |
| suricata |
ET ATTACK_RESPONSE EtherHiding Payload Delivery Script Observed Inbound |
rev 1 |
2026-05-13 |
| splunk |
Suspicious Curl Network Connection |
experimental |
2026-05-13 |
| splunk |
PowerShell WebRequest Using Memory Stream |
production |
2026-05-13 |
| splunk |
PowerShell Script Block With URL Chain |
production |
2026-05-13 |
| splunk |
Log4Shell CVE-2021-44228 Exploitation |
production |
2026-05-13 |
| splunk |
Living Off The Land Detection |
production |
2026-05-13 |
| splunk |
Detect Certify Command Line Arguments |
production |
2026-05-13 |
| splunk |
Curl Execution with Percent Encoded URL |
production |
2026-05-13 |
| splunk |
Microsoft Intune Mobile Apps |
experimental |
2026-05-13 |
| splunk |
Microsoft Intune Device Health Scripts |
production |
2026-05-13 |
| sigma |
PowerShell Download Via Net.WebClient - PowerShell Classic |
test |
2026-04-28 |
| snort |
ET ATTACK_RESPONSE MacSync Stealer Payload Inbound M2 |
rev 1 |
2026-04-06 |
| suricata |
ET ATTACK_RESPONSE MacSync Stealer Payload Inbound M2 |
rev 1 |
2026-04-06 |
| suricata |
ET ATTACK_RESPONSE MacSync Stealer Payload Inbound M1 |
rev 1 |
2026-04-06 |
| snort |
ET ATTACK_RESPONSE MacSync Stealer Payload Inbound M1 |
rev 1 |
2026-04-06 |
| sigma |
Axios NPM Compromise Indicators - Windows |
experimental |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Request M1 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Request M2 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Request M3 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Request M4 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Inbound M1 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Inbound M2 |
rev 1 |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - macOS |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - Linux |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise File Creation Indicators - MacOS |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise File Creation Indicators - Linux |
experimental |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Inbound M2 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Inbound M1 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M4 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M3 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M2 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M1 |
rev 1 |
2026-04-01 |
| sigma |
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location |
test |
2026-03-29 |
| sigma |
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE |
test |
2026-03-29 |
| sigma |
Suspicious Download From File-Sharing Website Via Bitsadmin |
test |
2026-03-29 |
| sigma |
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder |
test |
2026-03-29 |
| suricata |
ET ATTACK_RESPONSE InstallFix MacOS Payload Inbound |
rev 1 |
2026-03-25 |
| snort |
ET ATTACK_RESPONSE InstallFix MacOS Payload Inbound |
rev 1 |
2026-03-25 |
| suricata |
ET ATTACK_RESPONSE ASP.NET Web BackDoor Webshell Title Banner Observed |
rev 1 |
2026-03-10 |
| snort |
ET ATTACK_RESPONSE ASP.NET Web BackDoor Webshell Title Banner Observed |
rev 1 |
2026-03-10 |
| snort |
ET TROJAN DefendNot Installer Script Inbound |
rev 1 |
2026-03-06 |
| suricata |
ET MALWARE DefendNot Installer Payload Request |
rev 1 |
2026-03-06 |
| suricata |
ET MALWARE DefendNot Installer Script Inbound |
rev 1 |
2026-03-06 |
| snort |
ET TROJAN DefendNot Installer Payload Request |
rev 1 |
2026-03-06 |
| sigma |
Potentially Suspicious File Creation by OpenEDR's ITSMService |
experimental |
2026-02-19 |
| snort |
ET TROJAN BlackSanta Payload Inbound |
rev 1 |
2026-02-19 |
| snort |
ET TROJAN BlackSanta Payload Request |
rev 1 |
2026-02-19 |
| suricata |
ET MALWARE BlackSanta Payload Inbound |
rev 1 |
2026-02-19 |
| suricata |
ET MALWARE BlackSanta Payload Request |
rev 1 |
2026-02-19 |
| snort |
ET TROJAN HTTP Request to Known Stealer Payload Delivery Host |
rev 1 |
2026-01-22 |
| suricata |
ET MALWARE HTTP Request to Known Stealer Payload Delivery Host |
rev 1 |
2026-01-22 |
| suricata |
ET ATTACK_RESPONSE 123Stealer Payload Inbound |
rev 1 |
2026-01-12 |
| snort |
ET ATTACK_RESPONSE 123Stealer Payload Inbound |
rev 1 |
2026-01-12 |
| suricata |
ET ATTACK_RESPONSE GETA RAT Obfuscated Payload Inbound |
rev 1 |
2026-01-09 |
| snort |
ET ATTACK_RESPONSE GETA RAT Obfuscated Payload Inbound |
rev 1 |
2026-01-09 |
| suricata |
ET ATTACK_RESPONSE JScriptToPowerShell Obfuscator Payload Inbound |
rev 1 |
2025-12-26 |
| snort |
ET ATTACK_RESPONSE JScriptToPowerShell Obfuscator Payload Inbound |
rev 1 |
2025-12-26 |
| suricata |
ET MALWARE ZeitLoader Payload Retrieval attempt |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN ZeitLoader Payload Retrieval attempt |
rev 1 |
2025-12-18 |
| sigma |
File Download Via Bitsadmin To A Suspicious Target Folder |
test |
2025-12-10 |
| sigma |
Suspicious Download Via Certutil.EXE |
test |
2025-12-01 |
| sigma |
Suspicious File Downloaded From Direct IP Via Certutil.EXE |
test |
2025-12-01 |
| sigma |
Suspicious File Created by ArcSOC.exe |
experimental |
2025-11-25 |
| snort |
ET TROJAN Observed VBScript Payload Downloader Inbound |
rev 1 |
2025-11-04 |
| suricata |
ET MALWARE Observed VBScript Payload Downloader Inbound |
rev 1 |
2025-11-04 |
| snort |
ET TROJAN Amadey PowerShell Loader Inbound |
rev 1 |
2025-10-29 |
| suricata |
ET MALWARE Amadey PowerShell Loader Inbound |
rev 1 |
2025-10-29 |
| sigma |
Suspicious CertReq Command to Download |
experimental |
2025-10-29 |
| sigma |
File Download From Browser Process Via Inline URL |
test |
2025-10-27 |
| suricata |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2 |
rev 1 |
2025-10-08 |
| suricata |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1 |
rev 1 |
2025-10-08 |
| snort |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1 |
rev 1 |
2025-10-08 |
| snort |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2 |
rev 1 |
2025-10-08 |
| sigma |
File Download with Headless Browser |
test |
2025-10-07 |
| snort |
ET ATTACK_RESPONSE Braodo Loader Inbound |
rev 1 |
2025-10-02 |
| suricata |
ET ATTACK_RESPONSE Braodo Loader Inbound |
rev 1 |
2025-10-02 |
| suricata |
ET HUNTING WebDAV Retrieving .ps1 |
rev 1 |
2025-09-30 |
| snort |
ET INFO WebDAV Retrieving .ps1 |
rev 1 |
2025-09-30 |
| snort |
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound |
rev 1 |
2025-09-02 |
| suricata |
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound |
rev 1 |
2025-09-02 |
| snort |
ET ATTACK_RESPONSE KoiStealer Payload Inbound |
rev 1 |
2025-08-25 |
| suricata |
ET ATTACK_RESPONSE KoiStealer Payload Inbound |
rev 1 |
2025-08-25 |
| snort |
ET TROJAN KoiStealer Payload Reqeust |
rev 1 |
2025-08-25 |
| suricata |
ET MALWARE KoiStealer Payload Reqeust |
rev 1 |
2025-08-25 |
| suricata |
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound |
rev 1 |
2025-08-20 |
| snort |
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound |
rev 1 |
2025-08-20 |
| sigma |
Suspicious Invoke-WebRequest Execution |
test |
2025-07-18 |
| sigma |
Potential DLL File Download Via PowerShell Invoke-WebRequest |
test |
2025-07-18 |
| suricata |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| suricata |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| snort |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| snort |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| sigma |
Process Execution From WebDAV Share |
experimental |
2025-06-13 |
| sigma |
Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load |
experimental |
2025-06-13 |
| sigma |
Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access |
experimental |
2025-06-13 |
| sigma |
Potential Exploitation of RCE Vulnerability CVE-2025-33053 |
experimental |
2025-06-13 |
| suricata |
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound |
rev 1 |
2025-06-06 |
| snort |
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound |
rev 1 |
2025-06-06 |
| sigma |
PowerShell MSI Install via WindowsInstaller COM From Remote Location |
experimental |
2025-06-05 |
| sigma |
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server |
experimental |
2025-05-29 |
| sigma |
Suspicious Deno File Written from Remote Source |
experimental |
2025-05-22 |
| snort |
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound |
rev 1 |
2025-05-05 |
| suricata |
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound |
rev 1 |
2025-05-05 |
| snort |
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain |
rev 1 |
2025-04-24 |
| suricata |
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain |
rev 1 |
2025-04-24 |
| suricata |
ET ATTACK_RESPONSE ClickFix Related Payload Inbound |
rev 1 |
2025-04-24 |
| snort |
ET ATTACK_RESPONSE ClickFix Related Payload Inbound |
rev 1 |
2025-04-24 |
| suricata |
ET ATTACK_RESPONSE ClickFix Webpage Inbound |
rev 1 |
2025-04-18 |
| snort |
ET ATTACK_RESPONSE ClickFix Webpage Inbound |
rev 1 |
2025-04-18 |
| suricata |
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound |
rev 1 |
2025-03-27 |
| snort |
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound |
rev 1 |
2025-03-27 |
| snort |
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound |
rev 1 |
2025-03-07 |
| suricata |
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound |
rev 1 |
2025-03-07 |
| sigma |
Scheduled Task Creation with Curl and PowerShell Execution Combo |
experimental |
2025-02-05 |
| suricata |
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound |
rev 1 |
2025-01-29 |
| snort |
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound |
rev 1 |
2025-01-29 |
| snort |
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound |
rev 1 |
2025-01-29 |
| suricata |
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound |
rev 1 |
2025-01-29 |
| sigma |
PUA - Nimgrab Execution |
test |
2024-11-23 |
| sigma |
Hidden Flag Set On File/Directory Via Chflags - MacOS |
test |
2024-08-21 |
| sigma |
Finger.EXE Execution |
test |
2024-06-27 |
| sigma |
File Download Via Nscurl - MacOS |
test |
2024-06-04 |
| sigma |
Uncommon Network Connection Initiated By Certutil.EXE |
test |
2024-05-31 |
| sigma |
Network Connection Initiated From Users\Public Folder |
test |
2024-05-31 |
| sigma |
Local Network Connection Initiated By Script Interpreter |
test |
2024-05-31 |
| sigma |
Outbound Network Connection Initiated By Script Interpreter |
test |
2024-03-13 |
| sigma |
Replace.exe Usage |
test |
2024-03-13 |
| sigma |
Insensitive Subfolder Search Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Curl Download And Execute Combination |
test |
2024-03-05 |
| sigma |
Remote File Download Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE |
test |
2024-01-02 |
| sigma |
Network Connection Initiated By IMEWDBLD.EXE |
test |
2023-11-09 |
| sigma |
File Download Via Windows Defender MpCmpRun.EXE |
test |
2023-11-09 |
| sigma |
AppX Package Installation Attempts Via AppInstaller.EXE |
test |
2023-11-09 |
| sigma |
File Download And Execution Via IEExec.EXE |
test |
2023-11-09 |
| sigma |
File Download via CertOC.EXE |
test |
2023-10-18 |
| sigma |
File Download From IP Based URL Via CertOC.EXE |
test |
2023-10-18 |
| sigma |
Arbitrary File Download Via GfxDownloadWrapper.EXE |
test |
2023-10-18 |
| sigma |
DarkGate - Autoit3.EXE File Creation By Uncommon Process |
test |
2023-10-15 |
| sigma |
Browser Execution In Headless Mode |
test |
2023-09-12 |
| sigma |
Potential In-Memory Download And Compile Of Payloads |
test |
2023-08-22 |
| sigma |
Lolbas OneDriveStandaloneUpdater.exe Proxy Download |
test |
2023-08-17 |
| sigma |
Wget Creating Files in Tmp Directory |
test |
2023-06-02 |
| sigma |
Download File To Potentially Suspicious Directory Via Wget |
test |
2023-06-02 |
| sigma |
File With Suspicious Extension Downloaded Via Bitsadmin |
test |
2023-05-30 |
| sigma |
Suspicious Non-Browser Network Communication With Telegram API |
test |
2023-05-19 |
| sigma |
Download from Suspicious Dyndns Hosts |
test |
2023-05-18 |
| sigma |
Suspicious Curl File Upload - Linux |
test |
2023-05-02 |
| sigma |
Potential Data Exfiltration Via Curl.EXE |
test |
2023-05-02 |
| sigma |
Suspicious Invoke-WebRequest Execution With DirectIP |
test |
2023-04-21 |
| sigma |
Import LDAP Data Interchange Format File Via Ldifde.EXE |
test |
2023-03-14 |
| sigma |
Greenbug Espionage Group Indicators |
test |
2023-03-09 |
| sigma |
File Download Using Notepad++ GUP Utility |
test |
2023-03-02 |
| sigma |
Curl.EXE Execution |
test |
2023-02-21 |
| sigma |
Suspicious Curl.EXE Download |
test |
2023-02-21 |
| sigma |
File Download Via Curl.EXE |
test |
2023-02-21 |
| sigma |
File Download Via Bitsadmin |
test |
2023-02-15 |
| sigma |
Cisco Stage Data |
test |
2023-01-04 |
| sigma |
Potential COM Objects Download Cradles Usage - Process Creation |
test |
2022-12-25 |
| sigma |
Potential COM Objects Download Cradles Usage - PS Script |
test |
2022-12-25 |
| sigma |
Potential Download/Upload Activity Using Type Command |
test |
2022-12-14 |
| sigma |
Pandemic Registry Key |
test |
2022-10-09 |
| sigma |
Remote File Download Via Desktopimgdownldr Utility |
test |
2022-09-27 |
| sigma |
Curl Usage on Linux |
test |
2022-09-15 |
| sigma |
Suspicious Diantz Download and Compress Into a CAB File |
test |
2022-08-13 |
| sigma |
Suspicious Extrac32 Execution |
test |
2022-08-13 |
| sigma |
Suspicious Download from Office Domain |
test |
2022-08-02 |
| sigma |
Suspicious Desktopimgdownldr Target File |
test |
2022-06-02 |
| sigma |
Password Protected ZIP File Opened (Suspicious Filenames) |
test |
2022-05-09 |
| sigma |
PrintBrm ZIP Creation of Extraction |
test |
2022-05-02 |
| sigma |
Suspicious Dropbox API Usage |
test |
2022-04-20 |
| sigma |
MsiExec Web Install |
test |
2022-01-07 |
| sigma |
Executable from Webdav |
test |
2021-11-27 |
| sigma |
Suspicious Desktopimgdownldr Command |
test |
2021-11-27 |
| sigma |
Command Line Execution with Suspicious URL and AppData Strings |
test |
2021-11-27 |
| sigma |
Remote File Copy |
stable |
2020-06-18 |