| snort |
ET INFO Smocker Server Mock Tool Response |
rev 1 |
2023-10-25 |
| snort |
ET TROJAN Volt Typhoon User-Agent |
rev 1 |
2023-10-25 |
| snort |
ET TROJAN Golang Easy Stealer CnC Response |
rev 2 |
2023-10-25 |
| suricata |
ET MALWARE Volt Typhoon User-Agent |
rev 1 |
2023-10-25 |
| sigma |
Okta Password Health Report Query |
test |
2023-10-25 |
| sigma |
VsCode Code Tunnel Execution File Indicator |
test |
2023-10-25 |
| sigma |
Visual Studio Code Tunnel Remote File Creation |
test |
2023-10-25 |
| sigma |
Okta Admin Functions Access Through Proxy |
test |
2023-10-25 |
| sigma |
Renamed VsCode Code Tunnel Execution - File Indicator |
test |
2023-10-25 |
| sigma |
Visual Studio Code Tunnel Shell Execution |
test |
2023-10-25 |
| sigma |
Potentially Suspicious Child Process Of VsCode |
test |
2023-10-25 |
| sigma |
Visual Studio Code Tunnel Service Installation |
test |
2023-10-25 |
| sigma |
Diamond Sleet APT DNS Communication Indicators |
test |
2023-10-24 |
| sigma |
Onyx Sleet APT File Creation Indicators |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT Scheduled Task Creation |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT Scheduled Task Creation - Registry |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT Process Activity Indicators |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT DLL Sideloading Indicators |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT File Creation Indicators |
test |
2023-10-24 |
| sigma |
Security Software Discovery Via Powershell Script |
test |
2023-10-24 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default X509 Certificate String |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default Cert Issuer Common Name |
rev 2 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default Cert Subject Common Name |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default X509 Certificate |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default Cert Subject Common Name |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Subject Common Name |
rev 1 |
2023-10-23 |
| snort |
ET TROJAN LUMAR Stealer Exfiltration M2 |
rev 1 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default Cert Subject Common Name |
rev 1 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default Cert Subject Common Name |
rev 1 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default Cert Subject Common Name |
rev 2 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara4 Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Subject Common Name |
rev 2 |
2023-10-23 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraAX Default Cert Issuer Common Name |
rev 2 |
2023-10-23 |
| sigma |
MSI Installation From Suspicious Locations |
test |
2023-10-23 |
| sigma |
PowerShell Profile Modification |
test |
2023-10-23 |