| sigma |
DNS Query To Ufile.io |
test |
2023-09-18 |
| sigma |
DNS Query Request By Regsvr32.EXE |
test |
2023-09-18 |
| sigma |
Disabling Multi Factor Authentication |
test |
2023-09-18 |
| sigma |
Sysmon Blocked Executable |
test |
2023-09-16 |
| suricata |
ET MALWARE DarkGate AutoIt Downloader |
rev 1 |
2023-09-15 |
| sigma |
Diskshadow Child Process Spawned |
test |
2023-09-15 |
| sigma |
Potentially Suspicious Child Process Of DiskShadow.EXE |
test |
2023-09-15 |
| sigma |
Roles Activated Too Frequently |
test |
2023-09-14 |
| sigma |
Invalid PIM License |
test |
2023-09-14 |
| sigma |
Roles Assigned Outside PIM |
test |
2023-09-14 |
| sigma |
Too Many Global Admins |
test |
2023-09-14 |
| sigma |
Roles Are Not Being Used |
test |
2023-09-14 |
| sigma |
Roles Activation Doesn't Require MFA |
test |
2023-09-14 |
| sigma |
Stale Accounts In A Privileged Role |
test |
2023-09-14 |
| snort |
ET TROJAN Android/MMRAT CnC Checkin M1 |
rev 1 |
2023-09-13 |
| snort |
ET TROJAN Android/MMRAT CnC Checkin M2 |
rev 1 |
2023-09-13 |
| suricata |
ET MOBILE_MALWARE Android/MMRAT CnC Checkin M2 |
rev 1 |
2023-09-13 |
| suricata |
ET MOBILE_MALWARE Android/MMRAT CnC Checkin M1 |
rev 1 |
2023-09-13 |
| snort |
ET TROJAN Observed TA406 Related Domain in TLS SNI |
rev 1 |
2023-09-12 |
| snort |
ET TROJAN Cobalt Strike Beacon Activity |
rev 3 |
2023-09-12 |
| snort |
ET TROJAN Reptile Linux LKM Rootkit Backdoor Activity |
rev 1 |
2023-09-12 |
| snort |
ET CURRENT_EVENTS Sibhost Zip as Applet Archive July 08 2013 |
rev 4 |
2023-09-12 |
| snort |
ET TROJAN TA406 Related Domain in DNS Lookup |
rev 1 |
2023-09-12 |
| suricata |
ET MALWARE Observed TA406 Related Domain in TLS SNI |
rev 1 |
2023-09-12 |
| suricata |
ET MALWARE Reptile Linux LKM Rootkit Backdoor Activity |
rev 1 |
2023-09-12 |
| suricata |
ET MALWARE TA406 Related Domain in DNS Lookup |
rev 1 |
2023-09-12 |
| sigma |
Winrar Compressing Dump Files |
test |
2023-09-12 |
| sigma |
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE |
test |
2023-09-12 |
| sigma |
Browser Execution In Headless Mode |
test |
2023-09-12 |
| sigma |
Sysinternals Tools AppX Versions Execution |
test |
2023-09-12 |
| snort |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| snort |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| snort |
ET USER_AGENTS Observed Reconnaissance Related UA |
rev 1 |
2023-09-11 |
| suricata |
ET USER_AGENTS Observed Reconnaissance Related UA |
rev 1 |
2023-09-11 |
| suricata |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| suricata |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| sigma |
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE |
test |
2023-09-11 |
| sigma |
Chromium Browser Headless Execution To Mockbin Like Site |
test |
2023-09-11 |
| sigma |
Greedy File Deletion Using Del |
test |
2023-09-11 |
| sigma |
Application Termination Attempt via Wmic.EXE |
test |
2023-09-11 |