| sigma |
DarkGate - Autoit3.EXE Execution Parameters |
test |
2023-10-15 |
| snort |
ET WEB_SERVER Generic PHP Webshell Activity |
rev 1 |
2023-10-13 |
| suricata |
ET WEB_SERVER Generic PHP Webshell Activity |
rev 1 |
2023-10-13 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Attempt |
rev 1 |
2023-10-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Success |
rev 1 |
2023-10-12 |
| snort |
ET TROJAN Win32/MataDoor CnC Beacon Over UDP |
rev 1 |
2023-10-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Success |
rev 1 |
2023-10-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Attempt |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Success |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Attempt |
rev 1 |
2023-10-12 |
| suricata |
ET MALWARE Win32/MataDoor CnC Beacon Over UDP |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Attempt |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Success |
rev 1 |
2023-10-12 |
| sigma |
Renamed CURL.EXE Execution |
test |
2023-10-12 |
| snort |
ET WEB_CLIENT Possible Embedded NTLM Hash Theft Code |
rev 3 |
2023-10-11 |
| snort |
ET INFO Observed Pastebin Style Domain in TLS SNI |
rev 1 |
2023-10-11 |
| suricata |
ET INFO Observed Pastebin Style Domain in TLS SNI |
rev 1 |
2023-10-11 |
| suricata |
ET WEB_CLIENT Possible Embedded NTLM Hash Theft Code |
rev 3 |
2023-10-11 |
| sigma |
Granting Of Permissions To An Account |
test |
2023-10-11 |
| sigma |
Rare Subscription-level Operations In Azure |
test |
2023-10-11 |
| sigma |
HackTool - CoercedPotato Named Pipe Creation |
test |
2023-10-11 |
| sigma |
Control Panel Items |
test |
2023-10-11 |
| sigma |
Google Workspace Granted Domain API Access |
test |
2023-10-11 |
| sigma |
Number Of Resource Creation Or Deployment Activities |
test |
2023-10-11 |
| sigma |
Google Workspace Role Modified or Deleted |
test |
2023-10-11 |
| sigma |
Google Workspace MFA Disabled |
test |
2023-10-11 |
| sigma |
Google Workspace User Granted Admin Privileges |
test |
2023-10-11 |
| sigma |
Google Workspace Role Privilege Deleted |
test |
2023-10-11 |
| sigma |
Google Workspace Application Removed |
test |
2023-10-11 |
| sigma |
Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader |
test |
2023-10-11 |
| snort |
ET CURRENT_EVENTS MageCart 404 COOKIE_ANNOT |
rev 1 |
2023-10-10 |
| snort |
ET INFO LNK File Downloaded via HTTP |
rev 1 |
2023-10-10 |
| suricata |
ET PHISHING MageCart 404 COOKIE_ANNOT |
rev 1 |
2023-10-10 |
| sigma |
Remote Access Tool - ScreenConnect Temporary File |
test |
2023-10-10 |
| sigma |
Remote Access Tool - ScreenConnect File Transfer |
test |
2023-10-10 |
| sigma |
Remote Access Tool - ScreenConnect Command Execution |
test |
2023-10-10 |
| snort |
ET INFO ISO File Downloaded |
rev 1 |
2023-10-09 |
| suricata |
ET INFO ISO File Downloaded |
rev 1 |
2023-10-09 |
| sigma |
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream |
test |
2023-10-09 |
| sigma |
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI |
test |
2023-10-09 |