| snort |
ET TROJAN Possible OwlProxy activity M3 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M4 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M5 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M6 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M2 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Observed DNS Query to TA455 Domain |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M6 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M3 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M5 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M4 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Observed DNS Query to TA455 Domain |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M2 |
rev 1 |
2023-09-25 |
| elastic |
Deprecated - Potential DNS Tunneling via Iodine |
deprecated |
2023-09-25 |
| elastic |
Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable |
deprecated |
2023-09-25 |
| snort |
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M1 |
rev 2 |
2023-09-21 |
| snort |
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2 |
rev 3 |
2023-09-21 |
| snort |
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M3 |
rev 1 |
2023-09-21 |
| snort |
ET TROJAN Observed DNS Query to Win32/TrojanDropper.Agent.SLC Domain |
rev 2 |
2023-09-20 |
| sigma |
PsExec Tool Execution From Suspicious Locations - PipeName |
test |
2023-09-20 |
| snort |
ET TROJAN NewsPenguin CnC Checkin |
rev 2 |
2023-09-19 |
| snort |
ET TROJAN Suspected Periscope Framework Agent Related Activity |
rev 1 |
2023-09-19 |
| suricata |
ET MALWARE NewsPenguin CnC Checkin |
rev 3 |
2023-09-19 |
| sigma |
OneNote Attachment File Dropped In Suspicious Location |
test |
2023-09-19 |
| sigma |
Leviathan Registry Key Activity |
test |
2023-09-19 |
| snort |
ET TROJAN Blue Bot DDoS Proxy Request |
rev 6 |
2023-09-18 |
| snort |
ET TROJAN DarkGate AutoIt Downloader |
rev 2 |
2023-09-18 |
| snort |
ET POLICY Observed MSI Download |
rev 3 |
2023-09-18 |
| sigma |
DNS Server Discovery Via LDAP Query |
test |
2023-09-18 |
| sigma |
New Federated Domain Added |
test |
2023-09-18 |
| sigma |
DNS Query To Ufile.io |
test |
2023-09-18 |
| sigma |
TeamViewer Domain Query By Non-TeamViewer Application |
test |
2023-09-18 |
| sigma |
DNS Query Request By Regsvr32.EXE |
test |
2023-09-18 |
| sigma |
Network Connection Initiated By Regsvr32.EXE |
test |
2023-09-18 |
| sigma |
DNS Query To MEGA Hosting Website |
test |
2023-09-18 |
| sigma |
DLL Load By System Process From Suspicious Locations |
test |
2023-09-18 |
| sigma |
DNS Query To Ufile.io - DNS Client |
test |
2023-09-18 |
| sigma |
Uncommon Child Process Of AddinUtil.EXE |
test |
2023-09-18 |
| sigma |
Remote DLL Load Via Rundll32.EXE |
test |
2023-09-18 |
| sigma |
Disabling Multi Factor Authentication |
test |
2023-09-18 |
| sigma |
Suspicious AddinUtil.EXE CommandLine Execution |
test |
2023-09-18 |