| sigma |
Rundll32 Spawned Via Explorer.EXE |
test |
2023-08-31 |
| sigma |
CVE-2023-40477 Potential Exploitation - WinRAR Application Crash |
test |
2023-08-31 |
| sigma |
Path Traversal Exploitation Attempts |
test |
2023-08-31 |
| sigma |
Rundll32 Execution Without CommandLine Parameters |
test |
2023-08-31 |
| sigma |
Potentially Suspicious Child Process Of WinRAR.EXE |
test |
2023-08-31 |
| sigma |
IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32 |
test |
2023-08-31 |
| sigma |
CVE-2023-40477 Potential Exploitation - .REV File Creation |
test |
2023-08-31 |
| sigma |
CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File |
test |
2023-08-30 |
| snort |
ET TROJAN [ANY.RUN] Win32/RootTeam Stealer CnC Exfil M3 |
rev 2 |
2023-08-29 |
| sigma |
Suspicious Child Process Of Manage Engine ServiceDesk |
test |
2023-08-29 |
| sigma |
LSASS Dump Keyword In CommandLine |
test |
2023-08-29 |
| sigma |
LOLBIN Execution From Abnormal Drive |
test |
2023-08-29 |
| sigma |
Potentially Suspicious Compression Tool Parameters |
test |
2023-08-29 |
| snort |
ET TROJAN MacOS/Adload CnC Beacon |
rev 2 |
2023-08-28 |
| snort |
ET INFO WebDAV Retrieving .dll |
rev 1 |
2023-08-25 |
| snort |
ET TROJAN ReverseLoader Reverse Base64 Encoded Executable In Image M1 |
rev 1 |
2023-08-25 |
| snort |
ET MALWARE Suspected Adware/AccessMembre Checkin M2 |
rev 1 |
2023-08-25 |
| snort |
ET INFO WebDAV Retrieving .exe |
rev 1 |
2023-08-25 |
| snort |
ET MALWARE Suspected Adware/AccessMembre Checkin M3 |
rev 1 |
2023-08-25 |
| suricata |
ET MALWARE ReverseLoader Reverse Base64 Encoded Executable In Image M1 |
rev 1 |
2023-08-25 |
| suricata |
ET ADWARE_PUP Suspected Adware/AccessMembre Checkin M3 |
rev 1 |
2023-08-25 |
| suricata |
ET ADWARE_PUP Suspected Adware/AccessMembre Checkin M2 |
rev 1 |
2023-08-25 |
| snort |
ET TROJAN Covenant .NET Framework P2P C&C Protocol Gruntsvc Named Pipe Interaction |
rev 3 |
2023-08-24 |
| snort |
ET TROJAN Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| snort |
ET TROJAN Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| snort |
ET TROJAN CobaltStrike SMB P2P Default Msagent Named Pipe Interaction |
rev 5 |
2023-08-24 |
| snort |
ET TROJAN [ANY.RUN] Mekotio Banking Trojan TCP Request |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE [ANY.RUN] Mekotio Banking Trojan TCP Request |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Covenant .NET Framework P2P C&C Protocol Gruntsvc Named Pipe Interaction |
rev 2 |
2023-08-24 |
| suricata |
ET MALWARE Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Observed TA444 Domain in TLS SNI |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Observed TA444 Domain in TLS SNI |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE CobaltStrike SMB P2P Default Msagent Named Pipe Interaction |
rev 4 |
2023-08-24 |
| snort |
ET TROJAN Win32/PlugX Variant CnC Activity |
rev 2 |
2023-08-23 |
| snort |
ET TROJAN Carderbee APT Related Activity |
rev 1 |
2023-08-23 |
| suricata |
ET MALWARE Win32/PlugX Variant CnC Activity |
rev 2 |
2023-08-23 |
| suricata |
ET MALWARE Carderbee APT Related Activity |
rev 1 |
2023-08-23 |
| sigma |
SCR File Write Event |
test |
2023-08-23 |
| sigma |
Suspicious Execution Location Of Wermgr.EXE |
test |
2023-08-23 |