|
SIG:ET HUNTING Possible Sliver Age and Minisign Key Material in Internal TCP Stream
|
|
0
|
69
|
June 10, 2026
|
|
SIG: EarthWorm Reverse SOCKS Handshake and Tunnel Sequence Detection
|
|
6
|
198
|
May 27, 2026
|
|
SIG: BPFDoor icmpShell ICMP artifacts from Rapid7 whitepaper
|
|
12
|
921
|
May 14, 2026
|
|
SIG: Suspicious File Delivery from Cloudflare Family Host
|
|
7
|
193
|
April 10, 2026
|
|
SIGS: PoC for Axios NPM package supply chain compromise
|
|
3
|
122
|
April 1, 2026
|
|
Bug in emerging-ciarmy.rules?
|
|
4
|
73
|
December 4, 2025
|
|
False family: renaming rules from Lumma stealer to GCleaner loader
|
|
1
|
116
|
September 8, 2025
|
|
ET MALWARE Specter Insight Beacon CnC Checkin; sid: 2061025
|
|
2
|
231
|
April 14, 2025
|
|
PCRE in Sitecore CMS CSRFTOKEN Deserialization sid:2061119 for CVE-2019-9874
|
|
1
|
152
|
March 27, 2025
|
|
When loading rules for SID 2060960, 2060961, the message 'fast_pattern is ineffective with base64_data' occurs
|
|
1
|
113
|
March 25, 2025
|
|
ET WEB_SERVER Next.js CVE-2025-29927 middleware bypass attempt
|
|
1
|
136
|
March 24, 2025
|
|
Zyxel runCommandInShell Telnet Service - rule id 2060323
|
|
0
|
72
|
February 25, 2025
|
|
Sid:2055984 Ivanti Cloud Service Appliance Authenticated Command Injection (CVE-2024-8190)
|
|
1
|
174
|
October 1, 2024
|
|
PigButcher Credential Phish Landing Page Rules Error on Suricata 7
|
|
6
|
151
|
September 9, 2024
|
|
NMAP ruleset are FP?
|
|
1
|
167
|
September 5, 2024
|
|
DiamotrixClipper
|
|
2
|
347
|
August 30, 2024
|
|
NjRAT variant - tXRAT v.2.3R
|
|
1
|
234
|
June 21, 2024
|
|
ET MALWARE Generic Request to gate.php Dotted-Quad - Rule ID 2022986
|
|
1
|
380
|
January 29, 2024
|
|
IDS and IPS rules on LAN
|
|
1
|
690
|
January 22, 2024
|
|
Independant System Verification and Validation of Malware
|
|
2
|
231
|
December 28, 2023
|
|
Addressing an FP: 2016950 - ET MALWARE Possible Win32/Hupigon ip.txt with a Non-Mozilla UA
|
|
0
|
257
|
October 2, 2023
|
|
Possible FP - JA3 Hash - [Abuse.ch] Possible Adware
|
|
1
|
395
|
August 1, 2023
|
|
Possible FP: ET JA3 Hash - [Abuse.ch] Possible Adwind
|
|
3
|
802
|
July 14, 2023
|
|
Possible FP: ET MALWARE Sourtoff Receiving Simda Payload
|
|
4
|
413
|
July 7, 2023
|
|
GoodMorning Ransomware
|
|
7
|
512
|
June 23, 2023
|
|
Licensing: Is the Compromised-IPs list also 'Open'?
|
|
1
|
387
|
June 20, 2023
|
|
New Signature: MalDoc/Gamaredon CnC Activity
|
|
1
|
229
|
May 19, 2023
|
|
Need a feedback about Kerio Control rule that's blocking the web, domen, even application
|
|
3
|
399
|
May 1, 2023
|
|
Snort3, Snort2lua, and the Emerging Threats Snort 2.9 ruleset
|
|
2
|
4160
|
April 14, 2023
|