| suricata |
ET MALWARE SugarGh0st RAT CnC Checkin |
rev 1 |
2023-11-30 |
| suricata |
ET WEB_SERVER Simple JSP WebShell Landing Page |
rev 1 |
2023-11-30 |
| suricata |
ET HUNTING Successful PROPFIND Response for Application Media Type |
rev 1 |
2023-11-30 |
| sigma |
PUA - CSExec Default Named Pipe |
test |
2023-11-30 |
| sigma |
WMI Event Consumer Created Named Pipe |
test |
2023-11-30 |
| sigma |
Function Call From Undocumented COM Interface EditionUpgradeManager |
test |
2023-11-30 |
| sigma |
New PowerShell Instance Created |
test |
2023-11-30 |
| sigma |
Uncommon GrantedAccess Flags On LSASS |
test |
2023-11-30 |
| sigma |
PUA - RemCom Default Named Pipe |
test |
2023-11-30 |
| sigma |
ADFS Database Named Pipe Connection By Uncommon Tool |
test |
2023-11-30 |
| sigma |
Credential Dumping Attempt Via WerFault |
test |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M3 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M4 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M1 |
rev 1 |
2023-11-29 |
| snort |
ET WEB_SERVER /etc/hosts Detected in URI |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M2 |
rev 1 |
2023-11-29 |
| snort |
ET TROJAN [ANY.RUN] Socks5Systemz TCP Backconnect Client Traffic |
rev 1 |
2023-11-29 |
| snort |
ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded |
rev 2 |
2023-11-29 |
| snort |
ET TROJAN Win32/LeftHook Stealer Payload Inbound |
rev 2 |
2023-11-29 |
| snort |
ET WEB_SERVER /etc/passwd Detected in URI |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M1 |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M3 |
rev 1 |
2023-11-29 |
| suricata |
ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded |
rev 2 |
2023-11-29 |
| suricata |
ET MALWARE Win32/LeftHook Stealer Payload Inbound |
rev 2 |
2023-11-29 |
| suricata |
ET MALWARE [ANY.RUN] Socks5Systemz TCP Backconnect Client Traffic |
rev 1 |
2023-11-29 |
| suricata |
ET WEB_SERVER /etc/passwd Detected in URI |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M4 |
rev 1 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M2 |
rev 1 |
2023-11-29 |
| suricata |
ET WEB_SERVER /etc/hosts Detected in URI |
rev 1 |
2023-11-29 |
| sigma |
Remote LSASS Process Access Through Windows Remote Management |
stable |
2023-11-29 |
| sigma |
LSASS Access From Potentially White-Listed Processes |
test |
2023-11-29 |
| sigma |
LSASS Memory Access by Tool With Dump Keyword In Name |
test |
2023-11-29 |
| sigma |
Lsass Memory Dump via Comsvcs DLL |
test |
2023-11-29 |
| sigma |
Credential Dumping Activity By Python Based Tool |
stable |
2023-11-29 |
| sigma |
Mint Sandstorm - Log4J Wstomcat Process Execution |
test |
2023-11-29 |
| snort |
ET WEB_CLIENT WebDAV PUT Request for .url Flowbit Set |
rev 1 |
2023-11-28 |
| snort |
ET WEB_CLIENT WebDAV GET Request for .url Flowbit Set |
rev 1 |
2023-11-28 |
| suricata |
ET WEB_CLIENT PROPFIND Method Xbit Set |
rev 1 |
2023-11-28 |
| sigma |
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy |
test |
2023-11-28 |