| snort |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| suricata |
ET USER_AGENTS Observed Reconnaissance Related UA |
rev 1 |
2023-09-11 |
| suricata |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| suricata |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| sigma |
Application Termination Attempt via Wmic.EXE |
test |
2023-09-11 |
| sigma |
Greedy File Deletion Using Del |
test |
2023-09-11 |
| sigma |
Chromium Browser Headless Execution To Mockbin Like Site |
test |
2023-09-11 |
| sigma |
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE |
test |
2023-09-11 |
| sigma |
Suspicious Scripting in a WMI Consumer |
test |
2023-09-09 |
| sigma |
Fsutil Suspicious Invocation |
stable |
2023-09-09 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Obfuscation Redirect Observed M2 |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Redirect URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M4 |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M1 |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Check Add User URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET INFO JSCAPE MFT - Binary Management Service Default TLS Certificate |
rev 1 |
2023-09-08 |
| snort |
ET INFO JSCAPE MFT - HTTP Management Service Detected via Set-Cookie |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Obfuscation Redirect Observed M1 |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Check Expirations URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Password URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M2 |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M3 |
rev 1 |
2023-09-08 |
| suricata |
ET MALWARE Red Wolf/RedCurl Payload Retrieval Attempt M2 |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Password URL Struct |
rev 1 |
2023-09-08 |
| suricata |
ET MALWARE Red Wolf/RedCurl Payload Retrieval Attempt M3 |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Redirect URL Struct |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Check Add User URL Struct |
rev 1 |
2023-09-08 |
| suricata |
ET MALWARE Red Wolf/RedCurl Payload Retrieval Attempt M4 |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Obfuscation Redirect Observed M2 |
rev 1 |
2023-09-08 |
| suricata |
ET MALWARE Red Wolf/RedCurl Payload Retrieval Attempt M1 |
rev 1 |
2023-09-08 |
| suricata |
ET INFO JSCAPE MFT - Binary Management Service Default TLS Certificate |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Obfuscation Redirect Observed M1 |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Check Expirations URL Struct |
rev 1 |
2023-09-08 |
| suricata |
ET INFO JSCAPE MFT - HTTP Management Service Detected via Set-Cookie |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Win32/Bumblebee Loader Checkin Activity |
rev 1 |
2023-09-07 |
| suricata |
ET MALWARE Win32/Bumblebee Loader Checkin Activity |
rev 1 |
2023-09-07 |
| sigma |
DMP/HDMP File Creation |
test |
2023-09-07 |
| sigma |
Azure AD Threat Intelligence |
test |
2023-09-07 |
| sigma |
Malicious IP Address Sign-In Suspicious |
test |
2023-09-07 |
| sigma |
Primary Refresh Token Access Attempt |
test |
2023-09-07 |