| suricata |
ET MALWARE RedLine Stealer - CheckConnect Response |
rev 3 |
2023-12-13 |
| suricata |
ET MALWARE Win32/StormKitty CnC Telegram Notification M1 |
rev 3 |
2023-12-13 |
| suricata |
ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
rev 3 |
2023-12-13 |
| suricata |
ET MALWARE RaccoonStealer Admin Console Inbound |
rev 2 |
2023-12-13 |
| suricata |
ET MALWARE Suspected Kimsuky APT RevClient Related Activity |
rev 1 |
2023-12-13 |
| suricata |
ET MALWARE Win32/StormKitty CnC Telegram Notification M2 |
rev 3 |
2023-12-13 |
| sigma |
Potential Direct Syscall of NtOpenProcess |
test |
2023-12-13 |
| sigma |
Uncommon File Created In Office Startup Folder |
test |
2023-12-13 |
| sigma |
Dumping of Sensitive Hives Via Reg.EXE |
test |
2023-12-13 |
| snort |
ET INFO EXE extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| snort |
ET INFO wget in DNS TXT Response |
rev 1 |
2023-12-12 |
| snort |
ET INFO PDF extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| snort |
ET INFO vibe.d Library User-Agent |
rev 1 |
2023-12-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M1 |
rev 1 |
2023-12-12 |
| snort |
ET INFO curl in DNS TXT Response |
rev 1 |
2023-12-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M2 |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING curl in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING wget in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING EXE extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET INFO HTTP Outbound Request contains pw |
rev 5 |
2023-12-12 |
| suricata |
ET HUNTING PDF extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING vibe.d Library User-Agent |
rev 1 |
2023-12-12 |
| snort |
ET TROJAN Drivermax Utility Checkin Activity |
rev 1 |
2023-12-11 |
| snort |
ET TROJAN Win32/Asmodeasmo Bot CnC Checkin |
rev 1 |
2023-12-11 |
| suricata |
ET MALWARE Win32/Asmodeasmo Bot CnC Checkin |
rev 1 |
2023-12-11 |
| sigma |
PUA - Nmap/Zenmap Execution |
test |
2023-12-11 |
| sigma |
Uncommon Child Process Of Conhost.EXE |
test |
2023-12-11 |
| sigma |
Suspicious File Creation Activity From Fake Recycle.Bin Folder |
test |
2023-12-11 |
| sigma |
Suspicious Executable File Creation |
test |
2023-12-11 |
| sigma |
Suspicious Process Execution From Fake Recycle.Bin Folder |
test |
2023-12-11 |
| sigma |
Registry Persistence via Explorer Run Key |
test |
2023-12-11 |
| sigma |
Tap Installer Execution |
test |
2023-12-11 |
| sigma |
PUA - Radmin Viewer Utility Execution |
test |
2023-12-11 |
| sigma |
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE |
test |
2023-12-11 |
| sigma |
RDP Connection Allowed Via Netsh.EXE |
test |
2023-12-11 |
| sigma |
Locked Workstation |
stable |
2023-12-11 |
| sigma |
HH.EXE Execution |
test |
2023-12-11 |
| snort |
ET TROJAN ReverseLoader Reverse Base64 Encoded Executable In Image M2 |
rev 1 |
2023-12-08 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x |
rev 1 |
2023-12-08 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x |
rev 1 |
2023-12-08 |