| sigma |
Potential Attachment Manager Settings Attachments Tamper |
test |
2023-08-17 |
| sigma |
Suspicious Environment Variable Has Been Registered |
test |
2023-08-17 |
| sigma |
PowerShell as a Service in Registry |
test |
2023-08-17 |
| sigma |
PowerShell Logging Disabled Via Registry Key Tampering |
test |
2023-08-17 |
| sigma |
Suspicious Printer Driver Empty Manufacturer |
test |
2023-08-17 |
| sigma |
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG |
test |
2023-08-17 |
| sigma |
Tamper With Sophos AV Registry Keys |
test |
2023-08-17 |
| sigma |
Potential Encrypted Registry Blob Related To SNAKE Malware |
test |
2023-08-17 |
| sigma |
Potential COLDSTEEL RAT Windows User Creation |
test |
2023-08-17 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-08-09 |
rev 1 |
2023-08-16 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-08-09 |
rev 1 |
2023-08-16 |
| sigma |
New BgInfo.EXE Custom VBScript Registry Configuration |
test |
2023-08-16 |
| sigma |
Suspicious Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
Uncommon Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
New BgInfo.EXE Custom WMI Query Registry Configuration |
test |
2023-08-16 |
| sigma |
New BgInfo.EXE Custom DB Path Registry Configuration |
test |
2023-08-16 |
| sigma |
Indirect Command Execution From Script File Via Bash.EXE |
test |
2023-08-15 |
| sigma |
WSL Child Process Anomaly |
test |
2023-08-15 |
| sigma |
Indirect Inline Command Execution Via Bash.EXE |
test |
2023-08-15 |
| snort |
ET TROJAN APT29 HTA Dropper Checkin Observed |
rev 1 |
2023-08-14 |
| snort |
ET TROJAN APT29 Duke Variant Malware CnC Checkin Observed |
rev 1 |
2023-08-14 |
| suricata |
ET MALWARE APT29 HTA Dropper Checkin Observed |
rev 1 |
2023-08-14 |
| suricata |
ET ADWARE_PUP Tenorshare Google Analytics Checkin |
rev 2 |
2023-08-14 |
| suricata |
ET MALWARE APT29 Duke Variant Malware CnC Checkin Observed |
rev 1 |
2023-08-14 |
| sigma |
Assembly DLL Creation Via AspNetCompiler |
test |
2023-08-14 |
| sigma |
Suspicious Child Process of AspNetCompiler |
test |
2023-08-14 |
| snort |
ET TROJAN Filez Downloader Checkin |
rev 1 |
2023-08-11 |
| sigma |
Unsigned Mfdetours.DLL Sideloading |
test |
2023-08-11 |
| snort |
ET TROJAN VBS/Kimsuky UA Observed |
rev 3 |
2023-08-10 |
| snort |
ET TROJAN Reptile Rootkit Default ICMP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| snort |
ET TROJAN [ANY.RUN] Parallax RAT Check-In |
rev 1 |
2023-08-09 |
| snort |
ET TROJAN Reptile Rootkit Default TCP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| snort |
ET TROJAN Reptile Rootkit Default UDP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Reptile Rootkit Default ICMP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE [ANY.RUN] Parallax RAT Check-In |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Observed TA401 Related Domain in TLS SNI |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Reptile Rootkit Default UDP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Reptile Rootkit Default TCP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| sigma |
File Encryption Using Gpg4win |
test |
2023-08-09 |
| sigma |
Renamed Gpg.EXE Execution |
test |
2023-08-09 |