| sigma |
New Netsh Helper DLL Registered From A Suspicious Location |
test |
2023-11-28 |
| sigma |
Potential Credential Dumping Attempt Via PowerShell |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy |
test |
2023-11-28 |
| sigma |
Potential Process Hollowing Activity |
test |
2023-11-28 |
| sigma |
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths |
test |
2023-11-28 |
| sigma |
HackTool - CobaltStrike BOF Injection Pattern |
test |
2023-11-28 |
| sigma |
HackTool - LittleCorporal Generated Maldoc Injection |
test |
2023-11-28 |
| sigma |
HackTool - HandleKatz Duplicating LSASS Handle |
test |
2023-11-28 |
| sigma |
Load Of RstrtMgr.DLL By A Suspicious Process |
test |
2023-11-28 |
| sigma |
Potential Persistence Via Netsh Helper DLL |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver |
test |
2023-11-28 |
| snort |
ET TROJAN SysJoker User-Agent Observed |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN Socks5Systemz CnC Checkin M2 |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN SysJoker User-Agent Observed |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN Win32/CHAOS RAT/AlfaC2 Checkin |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN CHAOS RAT/AlfaC2 CnC Server Status Check |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN TA406 Win32/Updog Backdoor Data Exfiltration Attempt |
rev 1 |
2023-11-27 |
| suricata |
ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check |
rev 1 |
2023-11-27 |
| suricata |
ET MALWARE TA406 Win32/Updog Backdoor Data Exfiltration Attempt |
rev 1 |
2023-11-27 |
| sigma |
Exploitation Attempt Of CVE-2023-46214 Using Public POC Code |
test |
2023-11-27 |
| sigma |
Potential CVE-2023-46214 Exploitation Attempt |
test |
2023-11-27 |
| sigma |
HackTool - Generic Process Access |
test |
2023-11-27 |
| sigma |
Windows Defender Configuration Changes |
stable |
2023-11-24 |
| sigma |
Windows Defender Malware Detection History Deletion |
test |
2023-11-24 |
| sigma |
Enabling COR Profiler Environment Variables |
test |
2023-11-24 |
| sigma |
Execution of Suspicious File Type Extension |
test |
2023-11-23 |
| snort |
ET TROJAN TA422 Related Activity M5 |
rev 1 |
2023-11-22 |
| suricata |
ET MALWARE TA422 Related Activity M5 |
rev 1 |
2023-11-22 |
| sigma |
Windows Defender Real-time Protection Disabled |
stable |
2023-11-22 |
| sigma |
Windows Defender Malware And PUA Scanning Disabled |
stable |
2023-11-22 |
| sigma |
Windows Defender Virus Scanning Feature Disabled |
stable |
2023-11-22 |
| sigma |
PowerView PowerShell Cmdlets - ScriptBlock |
test |
2023-11-22 |
| sigma |
Windows Defender Grace Period Expired |
stable |
2023-11-22 |
| snort |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - EEPROM Reset |
rev 1 |
2023-11-21 |
| snort |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - System Restart Request |
rev 1 |
2023-11-21 |
| snort |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Request for lk3_settings.bin Backup File |
rev 1 |
2023-11-21 |
| suricata |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Request for lk3_settings.bin Backup File |
rev 1 |
2023-11-21 |
| suricata |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - System Restart Request |
rev 1 |
2023-11-21 |