| sigma |
Azure AD Threat Intelligence |
test |
2023-09-07 |
| sigma |
Malicious IP Address Sign-In Failure Rate |
test |
2023-09-07 |
| sigma |
DMP/HDMP File Creation |
test |
2023-09-07 |
| snort |
ET INFO Suspected Gamaredon Template Retrieval |
rev 1 |
2023-09-06 |
| sigma |
VMMap Signed Dbghelp.DLL Potential Sideloading |
test |
2023-09-05 |
| sigma |
VMMap Unsigned Dbghelp.DLL Potential Sideloading |
test |
2023-09-05 |
| sigma |
Old TLS1.0/TLS1.1 Protocol Version Enabled |
test |
2023-09-05 |
| sigma |
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI |
test |
2023-09-05 |
| sigma |
IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols |
test |
2023-09-05 |
| sigma |
ADS Zone.Identifier Deleted |
test |
2023-09-04 |
| sigma |
ESXi VM List Discovery Via ESXCLI |
test |
2023-09-04 |
| sigma |
ESXi VM Kill Via ESXCLI |
test |
2023-09-04 |
| sigma |
ESXi Syslog Configuration Change Via ESXCLI |
test |
2023-09-04 |
| sigma |
ESXi VSAN Information Discovery Via ESXCLI |
test |
2023-09-04 |
| sigma |
ESXi System Information Discovery Via ESXCLI |
test |
2023-09-04 |
| sigma |
ESXi Network Configuration Discovery Via ESXCLI |
test |
2023-09-04 |
| sigma |
SQL Injection Strings In URI |
test |
2023-09-04 |
| sigma |
ESXi Storage Information Discovery Via ESXCLI |
test |
2023-09-04 |
| sigma |
ESXi Admin Permission Assigned To Account Via ESXCLI |
test |
2023-09-04 |
| sigma |
Anomalous User Activity |
test |
2023-09-03 |
| sigma |
Activity From Anonymous IP Address |
test |
2023-09-03 |
| sigma |
Atypical Travel |
test |
2023-09-03 |
| sigma |
Impossible Travel |
test |
2023-09-03 |
| sigma |
Suspicious Inbox Forwarding Identity Protection |
test |
2023-09-03 |
| sigma |
Suspicious Inbox Manipulation Rules |
test |
2023-09-03 |
| sigma |
Azure AD Account Credential Leaked |
test |
2023-09-03 |
| sigma |
Sign-In From Malware Infected IP |
test |
2023-09-03 |
| sigma |
New Country |
test |
2023-09-03 |
| sigma |
Password Spray Activity |
test |
2023-09-03 |
| sigma |
Suspicious Browser Activity |
test |
2023-09-03 |
| sigma |
SAML Token Issuer Anomaly |
test |
2023-09-03 |
| sigma |
Unfamiliar Sign-In Properties |
test |
2023-09-03 |
| snort |
ET TROJAN [ANY.RUN] Konni.APT Keep-Alive |
rev 1 |
2023-09-01 |
| snort |
ET TROJAN Win32/RisePro CnC Server Response M4 |
rev 3 |
2023-09-01 |
| snort |
ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2023-09-01 |
rev 1 |
2023-09-01 |
| snort |
ET MOBILE_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration |
rev 1 |
2023-09-01 |
| snort |
ET TROJAN [ANY.RUN] Konni.APT Exfiltration |
rev 1 |
2023-09-01 |
| suricata |
ET PHISHING Facebook Credential Phish Landing Page 2023-09-01 |
rev 1 |
2023-09-01 |
| sigma |
New Port Forwarding Rule Added Via Netsh.EXE |
test |
2023-09-01 |
| sigma |
Qakbot Uninstaller Execution |
test |
2023-09-01 |