| snort |
ET TROJAN Ursnif Payload Downloader Inbound |
rev 1 |
2023-10-06 |
| snort |
ET CURRENT_EVENTS JavaScript DOS Injection |
rev 1 |
2023-10-06 |
| suricata |
ET MALWARE Ursnif Payload Downloader Inbound |
rev 1 |
2023-10-06 |
| snort |
ET TROJAN LNK/Sherlock Stealer Payload Inbound |
rev 1 |
2023-10-05 |
| suricata |
ET MALWARE LNK/Sherlock Stealer Payload Inbound |
rev 1 |
2023-10-05 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M1 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M3 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M2 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M4 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN Observed BlackDolphin Ransomware Builder Cookie |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M4 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M1 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M3 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M2 |
rev 1 |
2023-10-04 |
| snort |
ET CURRENT_EVENTS [TW] Trex Phishkit POST |
rev 1 |
2023-10-03 |
| suricata |
ET PHISHING [TW] Trex Phishkit POST |
rev 1 |
2023-10-03 |
| suricata |
ET MALWARE Observed BlackDolphin Ransomware Builder Cookie |
rev 1 |
2023-10-03 |
| sigma |
Uncommon Microsoft Office Trusted Location Added |
test |
2023-09-29 |
| sigma |
Potential Recon Activity Using DriverQuery.EXE |
test |
2023-09-29 |
| sigma |
DriverQuery.EXE Execution |
test |
2023-09-29 |
| sigma |
UAC Bypass via Event Viewer |
test |
2023-09-28 |
| sigma |
Potentially Suspicious Event Viewer Child Process |
test |
2023-09-28 |
| sigma |
COM Hijack via Sdclt |
test |
2023-09-28 |
| sigma |
Service Registry Key Read Access Request |
test |
2023-09-28 |
| sigma |
OceanLotus Registry Activity |
test |
2023-09-28 |
| snort |
ET TROJAN Win32/Gh0stRat C2 Checkin |
rev 1 |
2023-09-27 |
| snort |
ET TROJAN TA444 MacOS/ProcessRequest CnC Checkin |
rev 1 |
2023-09-27 |
| suricata |
ET MALWARE Win32/Gh0stRat C2 Checkin |
rev 1 |
2023-09-27 |
| suricata |
ET MALWARE TA444 MacOS/ProcessRequest CnC Checkin |
rev 1 |
2023-09-27 |
| sigma |
Scheduled Task Created - FileCreation |
test |
2023-09-27 |
| sigma |
Scheduled Task Created - Registry |
test |
2023-09-27 |
| sigma |
AWS Identity Center Identity Provider Change |
test |
2023-09-27 |
| snort |
ET TROJAN Alloy Taurus APT Zapoa Backdoor Activity |
rev 1 |
2023-09-26 |
| snort |
ET TROJAN Alloy Taurus Reshell Backdoor URI pattern Observed M1 |
rev 1 |
2023-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to softether .net Domain |
rev 1 |
2023-09-26 |
| snort |
ET TROJAN Alloy Taurus Reshell Backdoor URI pattern Observed M2 |
rev 1 |
2023-09-26 |
| suricata |
ET MALWARE Alloy Taurus APT Zapoa Backdoor Activity |
rev 1 |
2023-09-26 |
| suricata |
ET MALWARE Alloy Taurus Reshell Backdoor URI pattern Observed M2 |
rev 1 |
2023-09-26 |
| suricata |
ET MALWARE Alloy Taurus Reshell Backdoor URI pattern Observed M1 |
rev 1 |
2023-09-26 |
| sigma |
Linux Network Service Scanning - Auditd |
test |
2023-09-26 |