| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation System Data Details Information Disclosure Attempt |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-2488 Possible Unauthorized Access Attempt - Request for /css/sel.css |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-series Possible Unauthorized Access - Request for default.sel |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - Interface Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Routing Data |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3620 Default Cert Issuer Common Name |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-series Possible Unauthorized Access Attempt - Request for err401.sel |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Possible Unauthorized Access Attempt - Request for radevice.css |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Memory Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-series Possible Unauthorized Access - Request for home.sel |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - System List |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - UDP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation System Data Details Information Disclosure Attempt |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3620 Default Cert Subject Common Name |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Heap Memory Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Browse Chasis |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ICMP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - TCP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-2488 Possible Unauthorized Access Attempt - Request for /scripts/dScripts.sel |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Crashdump Display |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-2488 Possible Unauthorized Access Attempt - Request for /css/sel.css |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Chassis Detail Request |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ARP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-series Dropbear SSH Banner - Possible SSH Login attempt |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IGMP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3530-RTAC AcSELerator Firmware Activity |
rev 1 |
2023-10-18 |
| sigma |
ADSI-Cache File Creation By Uncommon Tool |
test |
2023-10-18 |
| sigma |
Arbitrary File Download Via GfxDownloadWrapper.EXE |
test |
2023-10-18 |
| sigma |
File Download via CertOC.EXE |
test |
2023-10-18 |
| sigma |
File Download From IP URL Via Curl.EXE |
test |
2023-10-18 |
| sigma |
Suspicious LNK Double Extension File Created |
test |
2023-10-18 |
| sigma |
File Download From IP Based URL Via CertOC.EXE |
test |
2023-10-18 |
| sigma |
Potentially Suspicious Office Document Executed From Trusted Location |
test |
2023-10-18 |
| sigma |
PowerShell Script Execution Policy Enabled |
test |
2023-10-18 |
| sigma |
Rundll32.EXE Calling DllRegisterServer Export Function Explicitly |
test |
2023-10-17 |
| sigma |
Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly |
test |
2023-10-17 |
| sigma |
DarkGate - Autoit3.EXE File Creation By Uncommon Process |
test |
2023-10-15 |
| sigma |
DarkGate - User Created Via Net.EXE |
test |
2023-10-15 |
| sigma |
DarkGate - Autoit3.EXE Execution Parameters |
test |
2023-10-15 |