| sigma |
File Encryption Using Gpg4win |
test |
2023-08-09 |
| sigma |
File Encryption/Decryption Via Gpg4win From Suspicious Locations |
test |
2023-08-09 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.servehttp .com Domain |
rev 3 |
2023-08-08 |
| suricata |
ET HUNTING Generic .bin download from Dotted Quad |
rev 13 |
2023-08-08 |
| sigma |
Suspicious Provlaunch.EXE Child Process |
test |
2023-08-08 |
| sigma |
Potential Provlaunch.EXE Binary Proxy Execution Abuse |
test |
2023-08-08 |
| sigma |
Potential Provisioning Registry Key Abuse For Binary Proxy Execution |
test |
2023-08-08 |
| snort |
ET TROJAN [ANY.RUN] Phemedrone Stealer Exfiltration via Telegram |
rev 1 |
2023-08-07 |
| snort |
ET CURRENT_EVENTS Parrot TDS Check M2 |
rev 1 |
2023-08-07 |
| snort |
ET TROJAN Redis-p2pinfect TLS Certificate Serial Number Observed in SSL Certificate |
rev 1 |
2023-08-07 |
| suricata |
ET MALWARE Redis-p2pinfect TLS Certificate Serial Number Observed in SSL Certificate |
rev 1 |
2023-08-07 |
| sigma |
Malicious Named Pipe Created |
test |
2023-08-07 |
| sigma |
HackTool - Koh Default Named Pipe |
test |
2023-08-07 |
| sigma |
HackTool - Credential Dumping Tools Named Pipe Created |
test |
2023-08-07 |
| sigma |
HackTool - DiagTrackEoP Default Named Pipe |
test |
2023-08-07 |
| sigma |
Injected Browser Process Spawning Rundll32 - GuLoader Activity |
test |
2023-08-07 |
| sigma |
Anomalous Token |
test |
2023-08-07 |
| sigma |
HackTool Service Registration or Execution |
test |
2023-08-07 |
| sigma |
CSExec Service Installation |
test |
2023-08-07 |
| sigma |
RemCom Service Installation |
test |
2023-08-07 |
| sigma |
RemCom Service File Creation |
test |
2023-08-04 |
| sigma |
PsExec Service Installation |
test |
2023-08-04 |
| sigma |
CSExec Service File Creation |
test |
2023-08-04 |
| sigma |
Potential Mpclient.DLL Sideloading |
test |
2023-08-04 |
| sigma |
Potential Mpclient.DLL Sideloading Via Defender Binaries |
test |
2023-08-04 |
| sigma |
Potential Mfdetours.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Linux Amazon SSM Agent Hijacking |
test |
2023-08-03 |
| sigma |
Potential Vivaldi_elf.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Mftrace.EXE Abuse |
test |
2023-08-03 |
| sigma |
Potential AVKkid.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential EACore.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution |
test |
2023-08-03 |
| sigma |
Potential Binary Proxy Execution Via VSDiagnostics.EXE |
test |
2023-08-03 |
| snort |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M1 |
rev 2 |
2023-08-02 |
| snort |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2 |
rev 2 |
2023-08-02 |
| snort |
ET WEB_SPECIFIC_APPS Metabase Setup-Token Information Disclosure - Required for CVE-2023-38646 |
rev 1 |
2023-08-02 |
| snort |
ET INFO Veeam Credential Recovery Script Inbound |
rev 1 |
2023-08-02 |
| suricata |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M1 |
rev 2 |
2023-08-02 |
| suricata |
ET WEB_SPECIFIC_APPS Metabase Setup-Token Information Disclosure - Required for CVE-2023-38646 |
rev 1 |
2023-08-02 |
| suricata |
ET HUNTING Veeam Credential Recovery Script Inbound |
rev 1 |
2023-08-02 |