| suricata |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2 |
rev 2 |
2023-08-02 |
| sigma |
Potential Amazon SSM Agent Hijacking |
test |
2023-08-02 |
| sigma |
Dynamic .NET Compilation Via Csc.EXE - Hunting |
test |
2023-08-02 |
| snort |
ET TROJAN Javascript Initiating Remote Server Search with Window's Search-MS URI Handler |
rev 1 |
2023-08-01 |
| suricata |
ET EXPLOIT Javascript Initiating Remote Server Search with Window's Search-MS URI Handler |
rev 1 |
2023-08-01 |
| elastic |
Suspicious Network Connection Attempt by Root |
deprecated |
2023-07-31 |
| snort |
ET TROJAN PennyWise Stealer Data Exfil M2 |
rev 4 |
2023-07-28 |
| snort |
ET TROJAN PennyWise Stealer Data Exfil M4 |
rev 1 |
2023-07-28 |
| suricata |
ET MALWARE PennyWise Stealer Data Exfil M2 |
rev 4 |
2023-07-28 |
| suricata |
ET MALWARE PennyWise Stealer Data Exfil M4 |
rev 1 |
2023-07-28 |
| sigma |
Potential CVE-2023-27997 Exploitation Indicators |
test |
2023-07-28 |
| sigma |
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request |
test |
2023-07-28 |
| sigma |
Data Compressed |
test |
2023-07-28 |
| snort |
ET TROJAN Pupy RAT Default TLS Proxy Certificate |
rev 1 |
2023-07-27 |
| snort |
ET TROJAN MalDoc/Gamaredon CnC Activity M4 |
rev 1 |
2023-07-27 |
| snort |
ET TROJAN [ANY.RUN] Hydrochasma Fast Reverse Proxy M3 |
rev 1 |
2023-07-27 |
| suricata |
ET MALWARE Pupy RAT Default TLS Proxy Certificate |
rev 1 |
2023-07-27 |
| suricata |
ET MALWARE MalDoc/Gamaredon CnC Activity M4 |
rev 1 |
2023-07-27 |
| sigma |
Insecure Proxy/DOH Transfer Via Curl.EXE |
test |
2023-07-27 |
| sigma |
Local File Read Using Curl.EXE |
test |
2023-07-27 |
| sigma |
Suspicious File Download From IP Via Wget.EXE |
test |
2023-07-27 |
| sigma |
Potential Cookies Session Hijacking |
test |
2023-07-27 |
| sigma |
Suspicious File Download From IP Via Curl.EXE |
test |
2023-07-27 |
| snort |
ET TROJAN NanoCore RAT CnC 7 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 1 |
rev 10 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 1 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 4 |
rev 3 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 2 |
rev 10 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 4 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 3 |
rev 6 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 3 |
rev 3 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT CnC 23 |
rev 1 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 2 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT CnC 24 |
rev 2 |
2023-07-26 |
| suricata |
ET MALWARE NanoCore RAT CnC 23 |
rev 1 |
2023-07-26 |
| suricata |
ET MALWARE NanoCore RAT CnC 24 |
rev 2 |
2023-07-26 |
| suricata |
ET MALWARE NanoCore RAT CnC 7 |
rev 2 |
2023-07-26 |
| snort |
ET USER_AGENTS Kimsuky CnC Checkin User-Agent |
rev 1 |
2023-07-25 |
| sigma |
VMToolsd Suspicious Child Process |
test |
2023-07-25 |
| sigma |
Windows Internet Hosted WebDav Share Mount Via Net.EXE |
test |
2023-07-25 |