| sigma |
Container Residence Discovery Via Proc Virtual FS |
test |
2023-08-23 |
| sigma |
Suspicious Execution Location Of Wermgr.EXE |
test |
2023-08-23 |
| sigma |
Devil Bait Potential C2 Communication Traffic |
test |
2023-08-23 |
| sigma |
Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location |
test |
2023-08-23 |
| sigma |
Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution |
test |
2023-08-23 |
| snort |
ET TROJAN Win32/Gomorrah Stealer Data Exfiltration |
rev 5 |
2023-08-22 |
| snort |
ET TROJAN Laplas Clipper - Regex CnC Request |
rev 5 |
2023-08-22 |
| snort |
ET TROJAN Laplas Clipper - GetAddress CnC Checkin |
rev 4 |
2023-08-22 |
| snort |
ET TROJAN Laplas Clipper - SetOnline CnC Checkin |
rev 4 |
2023-08-22 |
| suricata |
ET MALWARE Laplas Clipper - SetOnline CnC Checkin |
rev 4 |
2023-08-22 |
| suricata |
ET MALWARE Laplas Clipper - Regex CnC Request |
rev 5 |
2023-08-22 |
| suricata |
ET MALWARE Laplas Clipper - GetAddress CnC Checkin |
rev 4 |
2023-08-22 |
| sigma |
User Added To Admin Group Via DseditGroup |
test |
2023-08-22 |
| sigma |
Root Account Enable Via Dsenableroot |
test |
2023-08-22 |
| sigma |
JAMF MDM Potential Suspicious Child Process |
test |
2023-08-22 |
| sigma |
JAMF MDM Execution |
test |
2023-08-22 |
| sigma |
ESXi Account Creation Via ESXCLI |
test |
2023-08-22 |
| sigma |
Python Function Execution Security Warning Disabled In Excel |
test |
2023-08-22 |
| sigma |
Masquerading as Linux Crond Process |
test |
2023-08-22 |
| sigma |
Potential In-Memory Download And Compile Of Payloads |
test |
2023-08-22 |
| sigma |
Anonymous IP Address |
test |
2023-08-22 |
| sigma |
Potentially Suspicious WebDAV LNK Execution |
test |
2023-08-21 |
| sigma |
WebDAV Temporary Local File Creation |
test |
2023-08-21 |
| sigma |
Microsoft Office Trusted Location Updated |
test |
2023-08-17 |
| sigma |
Wow6432Node Classes Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
System Scripts Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Potential Encrypted Registry Blob Related To SNAKE Malware |
test |
2023-08-17 |
| sigma |
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 |
test |
2023-08-17 |
| sigma |
Assembly Loading Via CL_LoadAssembly.ps1 |
test |
2023-08-17 |
| sigma |
Potential Process Execution Proxy Via CL_Invocation.ps1 |
test |
2023-08-17 |
| sigma |
Potential COLDSTEEL RAT Windows User Creation |
test |
2023-08-17 |
| sigma |
Lsass Full Dump Request Via DumpType Registry Settings |
test |
2023-08-17 |
| sigma |
Session Manager Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Suspicious Set Value of MSDT in Registry (CVE-2022-30190) |
test |
2023-08-17 |
| sigma |
Hide Schedule Task Via Index Value Tamper |
test |
2023-08-17 |
| sigma |
Small Sieve Malware Registry Persistence |
test |
2023-08-17 |
| sigma |
Internet Explorer Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
CVE-2021-31979 CVE-2021-33771 Exploits |
test |
2023-08-17 |
| sigma |
WinSock2 Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Add Debugger Entry To AeDebug For Persistence |
test |
2023-08-17 |