| sigma |
Uncommon Userinit Child Process |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver) |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy) |
test |
2023-11-14 |
| sigma |
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE |
test |
2023-11-14 |
| sigma |
Security Tools Keyword Lookup Via Findstr.EXE |
test |
2023-11-14 |
| snort |
ET TROJAN Win32/TA402 CnC Response M1 |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Win32/TA402 CnC User-Agent |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Win32/TA402 Checkin M2 |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Win32/TA402 CnC Response M2 |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Observed TA402 Domain in TLS SNI |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Win32/TA402 CnC Response M2 |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Observed TA402 Domain in TLS SNI |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Win32/TA402 CnC Response M1 |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Win32/TA402 CnC User-Agent |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Observed TA402 Domain in TLS SNI |
rev 1 |
2023-11-13 |
| sigma |
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp |
test |
2023-11-13 |
| sigma |
Suspicious Windows Update Agent Empty Cmdline |
test |
2023-11-11 |
| sigma |
Findstr GPP Passwords |
test |
2023-11-11 |
| sigma |
Non-DLL Extension File Renamed With DLL Extension |
test |
2023-11-11 |
| sigma |
Suspicious Appended Extension |
test |
2023-11-11 |
| sigma |
Proxy Execution Via Wuauclt.EXE |
test |
2023-11-11 |
| sigma |
Permission Misconfiguration Reconnaissance Via Findstr.EXE |
test |
2023-11-11 |
| sigma |
Windows Defender Exclusion List Modified |
test |
2023-11-11 |
| sigma |
Windows Defender Exclusion Registry Key - Write Access Requested |
test |
2023-11-11 |
| snort |
ET TROJAN Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 |
rev 1 |
2023-11-10 |
| snort |
ET TROJAN Win32/Unknown RAT CnC Server Acknowledgement |
rev 1 |
2023-11-10 |
| suricata |
ET MALWARE Win32/Unknown RAT CnC Server Acknowledgement |
rev 1 |
2023-11-10 |
| sigma |
Remote Thread Creation Via PowerShell In Uncommon Target |
test |
2023-11-10 |
| sigma |
Suspicious WmiPrvSE Child Process |
test |
2023-11-10 |
| sigma |
Portable Gpg.EXE Execution |
test |
2023-11-10 |
| sigma |
Remote Thread Creation Via PowerShell |
test |
2023-11-10 |
| snort |
ET TROJAN MACE C2 Framework Response M1 |
rev 1 |
2023-11-09 |
| snort |
ET INFO Supabase Development Platform Related Domain in DNS Lookup |
rev 1 |
2023-11-09 |
| snort |
ET TROJAN Seetrol Remote Administration Tool Download |
rev 1 |
2023-11-09 |