| sigma |
Potential CVE-2023-36884 Exploitation Pattern |
test |
2023-07-12 |
| sigma |
Potential CVE-2023-36884 Exploitation - File Downloads |
test |
2023-07-12 |
| sigma |
Abusable DLL Potential Sideloading From Suspicious Location |
test |
2023-07-11 |
| snort |
ET TROJAN [ANY.RUN] Hydrochasma Fast Reverse Proxy M2 |
rev 1 |
2023-07-10 |
| suricata |
ET MALWARE [ANY.RUN] Hydrochasma Fast Reverse Proxy M2 |
rev 2 |
2023-07-10 |
| sigma |
Active Directory Computers Enumeration With Get-AdComputer |
test |
2023-07-08 |
| sigma |
Windows Mail App Mailbox Access Via PowerShell Script |
test |
2023-07-08 |
| snort |
ET TROJAN ASPXSPY - Manic Menagerie Variant Activity M1 |
rev 1 |
2023-07-07 |
| snort |
ET CURRENT_EVENTS Successful SFR Mail Credential Phish 2023-07-07 |
rev 1 |
2023-07-07 |
| suricata |
ET PHISHING Successful SFR Mail Credential Phish 2023-07-07 |
rev 1 |
2023-07-07 |
| suricata |
ET WEB_SERVER ASPXSPY - Manic Menagerie Variant Activity M1 |
rev 1 |
2023-07-07 |
| snort |
ET INFO Abnormal User-Agent No space after colon - Likely Hostile |
rev 13 |
2023-07-06 |
| snort |
ET GAMES FreeRide Games |
rev 7 |
2023-07-06 |
| snort |
ET TROJAN ASPXSPY Webshell Login Attempt |
rev 1 |
2023-07-06 |
| suricata |
ET WEB_SERVER ASPXSPY Webshell Login Attempt |
rev 1 |
2023-07-06 |
| snort |
ET INFO DYNAMIC_DNS Query to local .gd Domain |
rev 1 |
2023-07-05 |
| snort |
ET INFO DYNAMIC_DNS Query to nip .io Domain |
rev 1 |
2023-07-05 |
| snort |
ET TROJAN Win32/Ramgex.D Checkin |
rev 1 |
2023-07-05 |
| suricata |
ET MALWARE Win32/Ramgex.D Checkin |
rev 1 |
2023-07-05 |
| elastic |
Reverse Shell Created via Named Pipe |
deprecated |
2023-07-04 |
| snort |
ET INFO IDrive Backup Connection |
rev 1 |
2023-07-03 |
| snort |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M1 |
rev 1 |
2023-07-03 |
| snort |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M3 |
rev 1 |
2023-07-03 |
| snort |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M2 |
rev 1 |
2023-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M1 |
rev 1 |
2023-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M2 |
rev 1 |
2023-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M3 |
rev 1 |
2023-07-03 |
| elastic |
Deprecated - Threat Intel Indicator Match |
deprecated |
2023-07-03 |
| elastic |
Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match |
deprecated |
2023-07-03 |
| sigma |
Potential Registry Reconnaissance Via PowerShell Script |
test |
2023-07-02 |
| snort |
ET TROJAN Win32/Repl_it Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| snort |
ET TROJAN Win32/Duino-Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| snort |
ET CURRENT_EVENTS Successful Yahoo Credential Phish 2023-06-30 |
rev 1 |
2023-06-30 |
| snort |
ET TROJAN Win32/Sinresby.B Checkin |
rev 1 |
2023-06-30 |
| suricata |
ET COINMINER Win32/Duino-Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| suricata |
ET COINMINER Win32/Repl_it Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| suricata |
ET MALWARE Win32/Sinresby.B Checkin |
rev 1 |
2023-06-30 |
| sigma |
Potential ReflectDebugger Content Execution Via WerFault.EXE |
test |
2023-06-30 |
| sigma |
Insecure Transfer Via Curl.EXE |
test |
2023-06-30 |
| snort |
ET INFO DERO Crypto Mining Related Domain in DNS Lookup |
rev 1 |
2023-06-29 |