| suricata |
ET MALWARE W32/AGENT.NXNX Checkin 2 |
rev 3 |
2024-03-06 |
| suricata |
ET MALWARE ELF/muBoT IRC Activity 3 |
rev 3 |
2024-03-06 |
| suricata |
ET MALWARE Win32/Dofoil.L Checkin |
rev 6 |
2024-03-06 |
| suricata |
ET EXPLOIT Possible Misfortune Cookie RomPager Server banner |
rev 4 |
2024-03-06 |
| suricata |
ET INFO Possible Firefox Plugin install |
rev 7 |
2024-03-06 |
| suricata |
ET INFO HTTP Request to a *.bg.tf domain |
rev 6 |
2024-03-06 |
| suricata |
ET MALWARE x0Proto Download Cmd |
rev 3 |
2024-03-06 |
| suricata |
ET WEB_SPECIFIC_APPS VS Panel showcat.php Cat_ID Parameter SQL Injection |
rev 7 |
2024-03-06 |
| suricata |
ET INFO HTTP Request to a *.be.ma domain |
rev 5 |
2024-03-06 |
| sigma |
Shell Context Menu Command Tampering |
test |
2024-03-06 |
| sigma |
Potential SentinelOne Shell Context Menu Scan Command Tampering |
test |
2024-03-06 |
| sigma |
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE |
test |
2024-03-06 |
| sigma |
Potentially Suspicious Ping/Copy Command Combination |
test |
2024-03-06 |
| sigma |
Forfiles Command Execution |
test |
2024-03-05 |
| sigma |
Potential Privilege Escalation To LOCAL SYSTEM |
test |
2024-03-05 |
| sigma |
Suspicious Ping/Del Command Combination |
test |
2024-03-05 |
| sigma |
Insensitive Subfolder Search Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Esentutl Steals Browser Information |
test |
2024-03-05 |
| sigma |
Curl Download And Execute Combination |
test |
2024-03-05 |
| sigma |
Remote File Download Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Suspicious Service Installation Script |
test |
2024-03-05 |
| sigma |
Enumerate All Information With Whoami.EXE |
test |
2024-03-05 |
| sigma |
Rebuild Performance Counter Values Via Lodctr.EXE |
test |
2024-03-05 |
| sigma |
Qakbot Regsvr32 Calc Pattern |
test |
2024-03-05 |
| sigma |
Diskshadow Script Mode - Execution From Potential Suspicious Location |
test |
2024-03-05 |
| sigma |
Diskshadow Script Mode - Uncommon Script Extension Execution |
test |
2024-03-05 |
| sigma |
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE |
test |
2024-03-05 |
| sigma |
Console CodePage Lookup Via CHCP |
test |
2024-03-05 |
| sigma |
Certificate Exported Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
File In Suspicious Location Encoded To Base64 Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
Suspicious File Encoded To Base64 Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
File Encoded To Base64 Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
DLL Loaded via CertOC.EXE |
test |
2024-03-05 |
| sigma |
New Generic Credentials Added Via Cmdkey.EXE |
test |
2024-03-05 |
| sigma |
Port Forwarding Activity Via SSH.EXE |
test |
2024-03-05 |
| sigma |
File Deletion Via Del |
test |
2024-03-05 |
| sigma |
Response File Execution Via Odbcconf.EXE |
test |
2024-03-05 |
| sigma |
New Root Certificate Installed Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
PsExec/PAExec Escalation to LOCAL SYSTEM |
test |
2024-03-05 |
| sigma |
Suspicious DLL Loaded via CertOC.EXE |
test |
2024-03-05 |