| sigma |
Potential Suspicious Execution From GUID Like Folder Names |
test |
2023-03-02 |
| sigma |
Arbitrary Binary Execution Using GUP Utility |
test |
2023-03-02 |
| sigma |
Suspicious Group And Account Reconnaissance Activity Using Net.EXE |
test |
2023-03-02 |
| sigma |
Potential Credential Dumping Via LSASS Process Clone |
test |
2023-03-02 |
| sigma |
File Download Using Notepad++ GUP Utility |
test |
2023-03-02 |
| snort |
ET CURRENT_EVENTS Successful CenturyLink Credential Phish 2023-03-01 |
rev 1 |
2023-03-01 |
| snort |
ET TROJAN Observed BlackLotus SSL Certificate Observed |
rev 1 |
2023-03-01 |
| suricata |
ET PHISHING Successful CenturyLink Credential Phish 2023-03-01 |
rev 1 |
2023-03-01 |
| sigma |
HackTool - RedMimicry Winnti Playbook Execution |
test |
2023-03-01 |
| snort |
ET CURRENT_EVENTS Successful Ionos Credential Phish 2023-02-28 |
rev 1 |
2023-02-28 |
| snort |
ET TROJAN NDSW/NDSX Javascript Inject |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Pipe Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Dash Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Percent Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Comma Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Tilde Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Octothorp Separated |
rev 1 |
2023-02-28 |
| snort |
ET TROJAN ReverseRat 3.0 CnC Checkin M1 |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Backtick Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Single Quote Separated |
rev 1 |
2023-02-28 |
| snort |
ET TROJAN ReverseRat 3.0 CnC Checkin M2 |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Double Quote Separated |
rev 1 |
2023-02-28 |
| suricata |
ET PHISHING Successful Ionos Credential Phish 2023-02-28 |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Comma Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Octothorp Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Tilde Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Percent Separated |
rev 1 |
2023-02-28 |
| suricata |
ET EXPLOIT_KIT NDSW/NDSX Javascript Inject |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Double Quote Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Dash Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Single Quote Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Pipe Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Backtick Separated |
rev 1 |
2023-02-28 |
| sigma |
Group Membership Reconnaissance Via Whoami.EXE |
test |
2023-02-28 |
| sigma |
Security Privileges Enumeration Via Whoami.EXE |
test |
2023-02-28 |
| sigma |
PsExec Service Execution |
test |
2023-02-28 |
| sigma |
Service Security Descriptor Tampering Via Sc.EXE |
test |
2023-02-28 |
| sigma |
Psexec Execution |
test |
2023-02-28 |
| sigma |
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE |
test |
2023-02-28 |
| sigma |
Suspicious Parent Double Extension File Execution |
test |
2023-02-28 |