| sigma |
SMB over QUIC Via PowerShell Script |
test |
2023-07-21 |
| sigma |
WinAPI Function Calls Via PowerShell Scripts |
test |
2023-07-21 |
| sigma |
SMB over QUIC Via Net.EXE |
test |
2023-07-21 |
| sigma |
WinAPI Library Calls Via PowerShell Scripts |
test |
2023-07-21 |
| snort |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| snort |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| suricata |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| suricata |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| sigma |
Use NTFS Short Name in Image |
test |
2023-07-20 |
| sigma |
Sysmon File Executable Creation Detected |
test |
2023-07-20 |
| sigma |
Sysmon Blocked File Shredding |
test |
2023-07-20 |
| snort |
ET TROJAN Kaiten User Agent |
rev 1 |
2023-07-19 |
| snort |
ET WEB_SPECIFIC_APPS Zimbra XSS via momoveto |
rev 1 |
2023-07-18 |
| snort |
ET CURRENT_EVENTS Vietnamese Govt Credential Phish M1 2023-07-18 |
rev 1 |
2023-07-18 |
| snort |
ET CURRENT_EVENTS Vietnamese Govt Credential Phish M3 2023-07-18 |
rev 1 |
2023-07-18 |
| snort |
ET CURRENT_EVENTS Vietnamese Govt Credential Phish M2 2023-07-18 |
rev 1 |
2023-07-18 |
| suricata |
ET PHISHING Vietnamese Govt Credential Phish M1 2023-07-18 |
rev 1 |
2023-07-18 |
| suricata |
ET PHISHING Vietnamese Govt Credential Phish M3 2023-07-18 |
rev 1 |
2023-07-18 |
| suricata |
ET WEB_SPECIFIC_APPS Zimbra XSS via momoveto |
rev 1 |
2023-07-18 |
| suricata |
ET PHISHING Vietnamese Govt Credential Phish M2 2023-07-18 |
rev 1 |
2023-07-18 |
| sigma |
Scheduled Task Executing Payload from Registry |
test |
2023-07-18 |
| sigma |
PowerShell Script Change Permission Via Set-Acl - PsScript |
test |
2023-07-18 |
| sigma |
PowerShell Set-Acl On Windows Folder - PsScript |
test |
2023-07-18 |
| sigma |
Windows Defender Definition Files Removed |
test |
2023-07-18 |
| sigma |
Firewall Rule Update Via Netsh.EXE |
test |
2023-07-18 |
| sigma |
Ursnif Redirection Of Discovery Commands |
test |
2023-07-16 |
| sigma |
Potentially Suspicious Call To Win32_NTEventlogFile Class |
test |
2023-07-13 |
| sigma |
Potential CVE-2023-36884 Exploitation - Share Access |
test |
2023-07-13 |
| sigma |
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet |
test |
2023-07-13 |
| sigma |
Potential CVE-2023-36884 Exploitation Dropped File |
test |
2023-07-13 |
| sigma |
Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript |
test |
2023-07-13 |
| sigma |
Potential CCleanerReactivator.DLL Sideloading |
test |
2023-07-13 |
| sigma |
Potential CCleanerDU.DLL Sideloading |
test |
2023-07-13 |
| snort |
ET TROJAN Storm-0978 RomCom RAT CnC Checkin |
rev 1 |
2023-07-12 |
| snort |
ET TROJAN Win32/RootTeam Stealer CnC Exfil M1 |
rev 1 |
2023-07-12 |
| snort |
ET TROJAN Win32/RootTeam Stealer CnC Exfil M2 |
rev 1 |
2023-07-12 |
| suricata |
ET MALWARE Win32/RootTeam Stealer CnC Exfil M2 |
rev 1 |
2023-07-12 |
| suricata |
ET MALWARE Win32/RootTeam Stealer CnC Exfil M1 |
rev 1 |
2023-07-12 |
| suricata |
ET MALWARE Storm-0978 RomCom RAT CnC Checkin |
rev 1 |
2023-07-12 |
| sigma |
Potential CVE-2023-36884 Exploitation - File Downloads |
test |
2023-07-12 |