| suricata |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - EEPROM Reset |
rev 1 |
2023-11-21 |
| sigma |
Suspicious Path In Keyboard Layout IME File Registry Value |
test |
2023-11-21 |
| sigma |
File or Folder Permissions Modifications |
test |
2023-11-21 |
| sigma |
Uncommon Extension In Keyboard Layout IME File Registry Value |
test |
2023-11-21 |
| snort |
ET INFO F5 BIG-IP - Failed Auth Due To Expired Password |
rev 1 |
2023-11-20 |
| snort |
ET SCAN LeakIX Inbound User-Agent |
rev 1 |
2023-11-20 |
| suricata |
ET INFO F5 BIG-IP - Failed Auth Due To Expired Password |
rev 1 |
2023-11-20 |
| suricata |
ET SCAN LeakIX Inbound User-Agent |
rev 1 |
2023-11-20 |
| sigma |
DNS Query To Visual Studio Code Tunnels Domain |
test |
2023-11-20 |
| sigma |
Network Connection Initiated To DevTunnels Domain |
test |
2023-11-20 |
| sigma |
Network Connection Initiated To Visual Studio Code Tunnels Domain |
test |
2023-11-20 |
| sigma |
DNS Query To Devtunnels Domain |
test |
2023-11-20 |
| sigma |
Important Windows Event Auditing Disabled |
test |
2023-11-17 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Pop-Up Details Response |
rev 1 |
2023-11-16 |
| snort |
ET INFO 302 Redirect to run .mocky .io |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Download Locations Response |
rev 1 |
2023-11-16 |
| snort |
ET INFO DLL File Download Request via Discord |
rev 1 |
2023-11-16 |
| snort |
ET INFO Redirect to Discord Attachment Download |
rev 1 |
2023-11-16 |
| snort |
ET INFO RAR File Download Request via Discord |
rev 1 |
2023-11-16 |
| snort |
ET INFO EXE File Download Request via Discord |
rev 3 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Pop-Up Details Request |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Checkin Response |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Request for QB Download Locations |
rev 1 |
2023-11-16 |
| snort |
ET INFO ZIP File Download Request via Discord |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Checkin |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Checkin Response |
rev 1 |
2023-11-16 |
| suricata |
ET HUNTING Redirect to Discord Attachment Download |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Request for QB Download Locations |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Checkin |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Download Locations Response |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Pop-Up Details Response |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Pop-Up Details Request |
rev 1 |
2023-11-16 |
| suricata |
ET HUNTING 302 Redirect to run .mocky .io |
rev 1 |
2023-11-16 |
| sigma |
Eventlog Cleared |
test |
2023-11-15 |
| sigma |
Windows Event Auditing Disabled |
test |
2023-11-15 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - System |
test |
2023-11-15 |
| sigma |
Important Windows Eventlog Cleared |
test |
2023-11-15 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - Security |
test |
2023-11-15 |
| snort |
ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2023-11-14 |
| suricata |
ET INFO Ipconfig Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2023-11-14 |