| suricata |
ET INFO Supabase Development Platform Related Domain in DNS Lookup |
rev 1 |
2023-11-09 |
| suricata |
ET USER_AGENTS Seetrol Client Remote Administration Tool User-Agent |
rev 1 |
2023-11-09 |
| suricata |
ET ADWARE_PUP Seetrol Remote Administration Tool Download |
rev 1 |
2023-11-09 |
| sigma |
Suspicious Calculator Usage |
test |
2023-11-09 |
| sigma |
Lace Tempest File Indicators |
test |
2023-11-09 |
| sigma |
File Download Via Windows Defender MpCmpRun.EXE |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via MSEDGE_PROXY.EXE |
test |
2023-11-09 |
| sigma |
Network Connection Initiated By IMEWDBLD.EXE |
test |
2023-11-09 |
| sigma |
Potentially Suspicious Electron Application CommandLine |
test |
2023-11-09 |
| sigma |
Lace Tempest PowerShell Evidence Eraser |
test |
2023-11-09 |
| sigma |
Lace Tempest PowerShell Launcher |
test |
2023-11-09 |
| sigma |
Lace Tempest Cobalt Strike Download |
test |
2023-11-09 |
| sigma |
Lace Tempest Malware Loader Execution |
test |
2023-11-09 |
| sigma |
ISO Image Mounted |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via PresentationHost.EXE |
test |
2023-11-09 |
| sigma |
File Download Using ProtocolHandler.exe |
test |
2023-11-09 |
| sigma |
XBAP Execution From Uncommon Locations Via PresentationHost.EXE |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via Squirrel.EXE |
test |
2023-11-09 |
| sigma |
Remote XSL Execution Via Msxsl.EXE |
test |
2023-11-09 |
| sigma |
Msxsl.EXE Execution |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via MSOHTMED.EXE |
test |
2023-11-09 |
| sigma |
File Download Via InstallUtil.EXE |
test |
2023-11-09 |
| sigma |
File Download And Execution Via IEExec.EXE |
test |
2023-11-09 |
| sigma |
smbexec.py Service Installation |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via IMEWDBLD.EXE |
test |
2023-11-09 |
| sigma |
AppX Package Installation Attempts Via AppInstaller.EXE |
test |
2023-11-09 |
| sigma |
Uncommon Child Process Of Appvlp.EXE |
test |
2023-11-09 |
| sigma |
Potential File Download Via MS-AppInstaller Protocol Handler |
test |
2023-11-09 |
| sigma |
Webshell Tool Reconnaissance Activity |
test |
2023-11-09 |
| sigma |
Webshell Hacking Activity Patterns |
test |
2023-11-09 |
| sigma |
Execute Code with Pester.bat |
test |
2023-11-09 |
| snort |
ET INFO HTTP GET Request for AutoItX3 |
rev 1 |
2023-11-08 |
| snort |
ET TROJAN Bandit Stealer Host Details Exfil |
rev 1 |
2023-11-08 |
| snort |
ET TROJAN Bandit Stealer Config Inbound |
rev 1 |
2023-11-08 |
| suricata |
ET MALWARE Bandit Stealer Host Details Exfil |
rev 1 |
2023-11-08 |
| suricata |
ET HUNTING HTTP GET Request for AutoItX3 |
rev 1 |
2023-11-08 |
| sigma |
CVE-2023-46747 Exploitation Activity - Webserver |
test |
2023-11-08 |
| sigma |
CVE-2023-46747 Exploitation Activity - Proxy |
test |
2023-11-08 |
| sigma |
Office Application Startup - Office Test |
test |
2023-11-08 |
| sigma |
F5 BIG-IP iControl Rest API Command Execution - Webserver |
test |
2023-11-08 |