| suricata |
ET MALWARE Matanbuchus CnC Tunneling Activity Inbound, E Subdomain for Exfil |
rev 1 |
2026-10-20 |
| suricata |
ET MALWARE Matanbuchus CnC Tunneling Activity, Session Established, * .microsoft \.com variant |
rev 1 |
2026-10-20 |
| snort |
ET TROJAN Matanbuchus CnC Tunneling Activity Inbound, Terminate Tunnel |
rev 1 |
2026-10-20 |
| snort |
ET TROJAN Matanbuchus CnC Tunneling Activity Inbound, E Subdomain for Exfil |
rev 1 |
2026-10-20 |
| snort |
ET TROJAN Matanbuchus CnC Tunneling Activity, DATA ACK |
rev 1 |
2026-10-20 |
| snort |
ET TROJAN Matanbuchus CnC Tunneling Activity, Session Established, * .microsoft \.com variant |
rev 1 |
2026-10-20 |
| suricata |
ET MALWARE Matanbuchus CnC Tunneling Activity Inbound, Terminate Tunnel |
rev 1 |
2026-10-20 |
| suricata |
ET MALWARE Matanbuchus CnC Tunneling Activity, DATA ACK |
rev 1 |
2026-10-20 |
| splunk |
Unusual SSH Client Banner |
production |
2026-10-12 |
| splunk |
Windows Ngrok Reverse Proxy Usage |
production |
2026-10-09 |
| splunk |
Windows SSH Proxy Command |
production |
2026-10-09 |
| elastic |
IPv4/IPv6 Forwarding Activity |
production |
2026-10-09 |
| suricata |
ET INFO kcptun Null Encryption Session Initiation - Snappy Compression |
rev 1 |
2026-10-08 |
| snort |
ET INFO kcptun Null Encryption Session Initiation - Snappy Compression |
rev 1 |
2026-10-08 |
| snort |
ET INFO kcptun Null Encryption Message Header |
rev 1 |
2026-10-08 |
| suricata |
ET INFO kcptun Null Encryption Message Header |
rev 1 |
2026-10-08 |
| elastic |
Port Forwarding Rule Addition |
production |
2026-10-06 |
| elastic |
Newly Observed IPSEC NAT Traversal Peer |
production |
2026-09-22 |
| elastic |
Potential DNS Tunneling via NULL or Long DNS Queries |
production |
2026-09-21 |
| elastic |
Potential Traffic Tunneling using QEMU |
production |
2026-09-18 |
| elastic |
Potential Tunneling via Tailscaled |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via Chisel Client |
production |
2026-09-18 |
| elastic |
Tunneling and/or Port Forwarding Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Curl SOCKS Proxy Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Curl SOCKS Proxy Activity from Unusual Parent |
production |
2026-09-18 |
| elastic |
Potential Tunneling via AWS IoT Secure Tunneling Localproxy |
production |
2026-09-18 |
| elastic |
Potential DNS Exfiltration via Excessive Chunked Queries |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via Yuze |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via Cloudflared |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Tunneling Detected |
production |
2026-09-18 |
| elastic |
Potential SSH Reverse Port Forwarding |
production |
2026-09-18 |
| elastic |
Potential DNS Tunneling via NsLookup |
production |
2026-09-18 |
| elastic |
Potential ICMP Tunneling Activity to the Internet |
production |
2026-09-18 |
| elastic |
DNS Tunneling |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via EarthWorm |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding via Command Line |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding via SSH Option |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding |
production |
2026-09-18 |
| elastic |
Suspicious Utility Launched via ProxyChains |
production |
2026-09-18 |
| elastic |
Linux SSH X11 Forwarding |
production |
2026-09-18 |
| elastic |
ProxyChains Activity |
production |
2026-09-18 |
| elastic |
Kubectl Network Configuration Modification |
production |
2026-09-18 |
| splunk |
Socat Remote TCP Connection with Local Echo Disabled |
production |
2026-08-27 |
| splunk |
Socat Network Listener Binding an Executable |
production |
2026-08-27 |
| splunk |
Cisco IOS XE Tunnel Interface Configuration |
production |
2026-05-20 |
| splunk |
Ngrok Reverse Proxy on Network |
production |
2026-05-13 |
| splunk |
Windows SoftEther VPN Masquerading as Legitimate Binary |
production |
2026-05-13 |
| splunk |
Windows Protocol Tunneling with Plink |
production |
2026-05-13 |
| splunk |
Windows Potential Cloudflared Tunnel Execution |
production |
2026-05-13 |
| splunk |
Windows Potential Cloudflared Network Connection |
production |
2026-05-13 |
| splunk |
Linux Ngrok Reverse Proxy Usage |
production |
2026-05-13 |
| splunk |
Okta Non-Standard VPN Usage |
experimental |
2026-05-13 |
| elastic |
Deprecated - Potential Protocol Tunneling via Chisel Server |
deprecated |
2026-02-04 |
| sigma |
Process Initiated Network Connection To Ngrok Domain |
test |
2025-07-30 |
| sigma |
Network Connection Initiated To BTunnels Domains |
test |
2024-09-13 |
| sigma |
Communication To LocaltoNet Tunneling Service Initiated |
test |
2024-06-17 |
| sigma |
Communication To LocaltoNet Tunneling Service Initiated - Linux |
test |
2024-06-17 |
| sigma |
Potentially Suspicious Usage Of Qemu |
test |
2024-06-03 |
| sigma |
Network Connection Initiated To Cloudflared Tunnels Domains |
test |
2024-05-27 |
| sigma |
RDP Over Reverse SSH Tunnel |
test |
2024-03-12 |
| sigma |
Port Forwarding Activity Via SSH.EXE |
test |
2024-03-05 |
| sigma |
Communication To Ngrok Tunneling Service Initiated |
test |
2024-02-02 |
| sigma |
Tunneling Tool Execution |
test |
2024-01-18 |
| sigma |
Cloudflared Tunnel Connections Cleanup |
test |
2023-12-21 |
| sigma |
Cloudflared Tunnel Execution |
test |
2023-12-20 |
| sigma |
Cloudflared Tunnels Related DNS Requests |
test |
2023-12-20 |
| sigma |
Network Connection Initiated To DevTunnels Domain |
test |
2023-11-20 |
| sigma |
DNS Query To Devtunnels Domain |
test |
2023-11-20 |
| sigma |
Network Connection Initiated To Visual Studio Code Tunnels Domain |
test |
2023-11-20 |
| elastic |
Deprecated - Potential DNS Tunneling via Iodine |
deprecated |
2023-09-25 |
| sigma |
Silence.EDA Detection |
test |
2023-04-03 |
| snort |
ET INFO playit .gg Tunneling Domain in DNS Lookup |
rev 1 |
2023-03-14 |
| suricata |
ET INFO playit .gg Tunneling Domain in DNS Lookup |
rev 1 |
2023-03-14 |
| sigma |
PUA - 3Proxy Execution |
test |
2023-02-21 |
| sigma |
PUA - Ngrok Execution |
test |
2023-02-21 |
| sigma |
Potential RDP Tunneling Via Plink |
test |
2023-01-27 |
| sigma |
Potential RDP Tunneling Via SSH |
test |
2023-01-25 |
| sigma |
Communication To Ngrok Tunneling Service - Linux |
test |
2022-11-03 |
| sigma |
Suspicious Plink Port Forwarding |
test |
2022-10-09 |
| sigma |
RDP to HTTP or HTTPS Target Ports |
test |
2022-07-14 |