| snort |
ET CURRENT_EVENTS BlueMoon Exploit Kit Status Callback |
rev 1 |
2026-10-14 |
| suricata |
ET EXPLOIT_KIT BlueMoon Exploit Kit Non-Worker Fallback Binary Payload |
rev 1 |
2026-10-14 |
| suricata |
ET EXPLOIT_KIT BlueMoon Exploit Kit Worker Binary Payload |
rev 1 |
2026-10-14 |
| suricata |
ET EXPLOIT_KIT BlueMoon Exploit Kit Status Callback |
rev 1 |
2026-10-14 |
| snort |
ET CURRENT_EVENTS BlueMoon Exploit Kit Worker Binary Payload |
rev 1 |
2026-10-14 |
| suricata |
ET EXPLOIT_KIT ClickFix Visitor Tracking |
rev 1 |
2026-10-06 |
| suricata |
ET MALWARE Base64 Encoded XML Declaration Within PNG File |
rev 1 |
2026-10-05 |
| snort |
ET TROJAN Base64 Encoded XML Declaration Within PNG File |
rev 1 |
2026-10-05 |
| snort |
ET TROJAN Base64 Encoded Executable Within PNG File |
rev 1 |
2026-10-05 |
| suricata |
ET MALWARE Base64 Encoded Executable Within PNG File |
rev 1 |
2026-10-05 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Cookie |
rev 1 |
2026-10-01 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Cookie |
rev 1 |
2026-10-01 |
| elastic |
Potential TerminalFix Cloudflare Lure in PowerShell |
production |
2026-09-28 |
| splunk |
Detect hosts connecting to dynamic domain providers |
production |
2026-09-22 |
| elastic |
WPS Office Exploitation via DLL Hijack |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Business App Installer |
production |
2026-09-18 |
| elastic |
Potential DNS Rebinding from Public to Private Address |
production |
2026-09-18 |
| elastic |
Suspicious Browser Child Process |
production |
2026-09-18 |
| elastic |
Unusual Web Request |
production |
2026-09-18 |
| elastic |
Potential Fake CAPTCHA Phishing Attack |
production |
2026-09-18 |
| suricata |
ET EXPLOIT_KIT Darksword iOS EK RCE Worker Page |
rev 1 |
2026-09-10 |
| snort |
ET CURRENT_EVENTS Darksword iOS EK RCE Worker Page |
rev 1 |
2026-09-10 |
| snort |
ET CURRENT_EVENTS Darksword iOS EK RCE Loader Page |
rev 1 |
2026-09-10 |
| snort |
ET CURRENT_EVENTS Darksword iOS EK Landing Page |
rev 1 |
2026-09-10 |
| suricata |
ET EXPLOIT_KIT Darksword iOS EK RCE Loader Page |
rev 1 |
2026-09-10 |
| suricata |
ET EXPLOIT_KIT Darksword iOS EK Landing Page |
rev 1 |
2026-09-10 |
| suricata |
ET EXPLOIT_KIT BlueMoon EK JS Loader M2 |
rev 1 |
2026-09-04 |
| snort |
ET CURRENT_EVENTS TA2726 CnC Request to Fake Wordpress Plugin M1 |
rev 1 |
2026-09-04 |
| snort |
ET CURRENT_EVENTS BlueMoon EK JS Loader M3 |
rev 1 |
2026-09-04 |
| snort |
ET CURRENT_EVENTS BlueMoon EK JS Loader M2 |
rev 1 |
2026-09-04 |
| snort |
ET CURRENT_EVENTS BlueMoon EK JS Loader M1 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT TA2726 CnC Response from admin-ajax.php |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT TA2726 CnC Request to Fake Wordpress Plugin M1 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT BlueMoon EK JS Loader M3 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT BlueMoon EK JS Loader M1 |
rev 1 |
2026-09-04 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M68 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M51 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M70 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M69 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M68 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M67 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M66 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M65 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M64 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M63 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M62 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M61 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M60 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M52 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M53 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M54 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M55 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M56 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M57 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M58 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M59 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M60 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M61 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M62 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M63 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M64 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M65 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M66 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M67 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M69 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M70 |
rev 1 |
2026-08-21 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M51 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M59 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M58 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M57 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M56 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M55 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M54 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M53 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M52 |
rev 1 |
2026-08-21 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M36 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M37 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M38 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M39 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M40 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M49 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M48 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M47 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M46 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M45 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M44 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M41 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M43 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M31 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M32 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M31 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M32 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M33 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M34 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M35 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M36 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M37 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M38 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M39 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M40 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M41 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M42 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M43 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M44 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M45 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M46 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M47 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M48 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M49 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M50 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M42 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M50 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M33 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M34 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M35 |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M29 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M21 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M22 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M23 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M24 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M25 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M26 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M27 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M28 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M29 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M30 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M21 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M22 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M23 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M24 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M25 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M26 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M27 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M28 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M30 |
rev 1 |
2026-08-18 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M11 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M19 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M20 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M19 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M18 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M12 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M12 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M17 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M16 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M15 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M14 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M13 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M13 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M14 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M18 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M15 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M16 |
rev 1 |
2026-08-14 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M17 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M20 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M11 |
rev 1 |
2026-08-14 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M5 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M10 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M9 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M8 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M7 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M6 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M2 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M4 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M3 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M2 |
rev 1 |
2026-08-13 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M1 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M1 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M10 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M9 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M8 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M7 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M6 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M5 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M4 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M3 |
rev 1 |
2026-08-13 |
| suricata |
ET HUNTING HTTP 300-Series Redirect to file URI attempt |
rev 8 |
2026-07-31 |
| snort |
ET INFO HTTP 300-Series Redirect to file URI attempt |
rev 2 |
2026-07-31 |
| snort |
ET EXPLOIT Balada Javascript Inject Observed |
rev 1 |
2026-06-17 |
| suricata |
ET EXPLOIT_KIT Balada Javascript Inject Observed |
rev 1 |
2026-06-17 |
| snort |
ET INFO Javascript Obfuscator Charcode+Hex Encoded Function Name |
rev 1 |
2026-06-16 |
| suricata |
ET HUNTING Javascript Obfuscator Charcode+Hex Encoded Function Name |
rev 1 |
2026-06-16 |
| suricata |
ET EXPLOIT_KIT Clearfake Set-Cookie Inbound M2 |
rev 1 |
2026-06-12 |
| snort |
ET TROJAN ClickFix Landing Page Observed |
rev 1 |
2026-06-09 |
| suricata |
ET MALWARE ClickFix Landing Page Observed |
rev 1 |
2026-06-09 |
| snort |
ET TROJAN Observed Fake Updates Page Inbound |
rev 1 |
2026-06-05 |
| suricata |
ET MALWARE Observed Fake Updates Page Inbound |
rev 1 |
2026-06-05 |
| splunk |
Splunk XSS Privilege Escalation via Custom Urls in Dashboard |
production |
2026-05-14 |
| suricata |
ET MALWARE Observed Fake Google Meet Page |
rev 1 |
2026-03-24 |
| snort |
ET TROJAN Observed Fake Google Meet Page |
rev 1 |
2026-03-24 |
| suricata |
ET EXPLOIT_KIT Coruna Stage 2 Implant Activity |
rev 1 |
2026-03-11 |
| suricata |
ET EXPLOIT_KIT Coruna Stage 3 Implant Activity M1 |
rev 1 |
2026-03-11 |
| suricata |
ET EXPLOIT_KIT Coruna Stage 3 Implant Activity M2 |
rev 1 |
2026-03-11 |
| suricata |
ET MALWARE Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| suricata |
ET MALWARE Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| suricata |
ET MALWARE Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| suricata |
ET MALWARE Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| snort |
ET TROJAN Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| snort |
ET TROJAN Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| snort |
ET TROJAN Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| snort |
ET TROJAN Observed ClickFix Landing Page |
rev 1 |
2026-02-27 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET EXPLOIT_KIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| snort |
ET EXPLOIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| snort |
ET EXPLOIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| suricata |
ET EXPLOIT_KIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| snort |
ET EXPLOIT Chrome V8 Shellcode Inject Attempt |
rev 1 |
2025-10-30 |
| suricata |
ET EXPLOIT Chrome V8 Shellcode Inject Attempt |
rev 1 |
2025-10-30 |
| suricata |
ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain |
rev 1 |
2025-09-19 |
| snort |
ET CURRENT_EVENTS Observed DNS Query to ClickFix Domain |
rev 1 |
2025-09-19 |
| snort |
ET CURRENT_EVENTS Observed DNS Query to ClickFix Domain |
rev 1 |
2025-09-19 |
| snort |
ET CURRENT_EVENTS Observed DNS Query to ClickFix Domain |
rev 1 |
2025-09-19 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Domain in TLS SNI |
rev 1 |
2025-09-19 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Domain in TLS SNI |
rev 1 |
2025-09-19 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Domain in TLS SNI |
rev 1 |
2025-09-19 |
| suricata |
ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain |
rev 1 |
2025-09-19 |
| suricata |
ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain |
rev 1 |
2025-09-19 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Webpage Inbound |
rev 1 |
2025-08-06 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Webpage Inbound |
rev 1 |
2025-08-06 |
| elastic |
Potential Cross Site Scripting (XSS) |
deprecated |
2025-03-04 |
| snort |
ET TROJAN Earth Minotaur MOONSHINE Exploit Kit URI Struct Detected |
rev 1 |
2025-01-02 |
| suricata |
ET MALWARE Earth Minotaur MOONSHINE Exploit Kit URI Struct Detected |
rev 1 |
2025-01-02 |
| snort |
ET WEB_CLIENT Internet Explorer execCommand function Use after free Vulnerability 0day Metasploit 2 |
rev 6 |
2024-11-26 |
| suricata |
ET WEB_CLIENT Internet Explorer execCommand function Use after free Vulnerability 0day Metasploit 2 |
rev 10 |
2024-11-26 |
| sigma |
Suspicious Browser Child Process - MacOS |
test |
2023-04-05 |
| sigma |
Flash Player Update from Suspicious Location |
test |
2022-08-08 |
| sigma |
Cross Site Scripting Strings |
test |
2022-06-14 |
| sentinel |
A client made a web request to a potentially harmful file (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
Application Gateway WAF - XSS Detection |
Scheduled |
— |
| sentinel |
Malformed user agent |
Scheduled |
— |