| suricata |
ET PHISHING HiYu - Victim Enrichment Response M2 |
rev 1 |
2023-02-24 |
| suricata |
ET PHISHING HiYu - Request for User Specific Landing Page |
rev 1 |
2023-02-24 |
| suricata |
ET PHISHING TA453 Phishing Domain in DNS Lookup |
rev 1 |
2023-02-24 |
| suricata |
ET PHISHING VigLink Redirect To HiYu Phishing Landing Page |
rev 2 |
2023-02-24 |
| suricata |
ET PHISHING HiYu - Victim Enrichment Response M1 |
rev 1 |
2023-02-24 |
| suricata |
ET PHISHING HiYu - Victim Enrichment Response M3 |
rev 1 |
2023-02-24 |
| suricata |
ET MALWARE PS1Loader Encoded Profiling POST |
rev 1 |
2023-02-24 |
| snort |
ET TROJAN ELF/muBoT IRC Activity 3 |
rev 2 |
2023-02-23 |
| snort |
ET TROJAN ELF/muBoT IRC Activity 2 |
rev 2 |
2023-02-23 |
| snort |
ET TROJAN ELF/muBoT IRC Activity 4 |
rev 2 |
2023-02-23 |
| snort |
ET TROJAN ELF/muBoT IRC Activity 5 |
rev 2 |
2023-02-23 |
| snort |
ET TROJAN Win32/Backdoor.Atharvan CnC Checkin |
rev 1 |
2023-02-23 |
| snort |
ET CURRENT_EVENTS Successful Royal Credit Union Credential Phish 2023-02-23 |
rev 1 |
2023-02-23 |
| snort |
ET TROJAN ELF/muBoT IRC Activity 1 |
rev 2 |
2023-02-23 |
| suricata |
ET MALWARE Win32/Backdoor.Atharvan CnC Checkin |
rev 1 |
2023-02-23 |
| suricata |
ET PHISHING Successful Royal Credit Union Credential Phish 2023-02-23 |
rev 1 |
2023-02-23 |
| sigma |
Potential SocGholish Second Stage C2 DNS Query |
test |
2023-02-23 |
| sigma |
Potential CVE-2023-23752 Exploitation Attempt |
test |
2023-02-23 |
| sigma |
DotNet CLR DLL Loaded By Scripting Applications |
test |
2023-02-23 |
| sigma |
Suspicious File Creation In Uncommon AppData Folder |
test |
2023-02-23 |
| sigma |
File Creation In Suspicious Directory By Msdt.EXE |
test |
2023-02-23 |
| sigma |
PSEXEC Remote Execution File Artefact |
test |
2023-02-23 |
| sigma |
Suspicious DotNET CLR Usage Log Artifact |
test |
2023-02-23 |
| sigma |
Potential Startup Shortcut Persistence Via PowerShell.EXE |
test |
2023-02-23 |
| snort |
ET INFO HTTP GET Request for freebl3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for softokn3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M2 2023-02-22 |
rev 1 |
2023-02-22 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for nss3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M3 2023-02-22 |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for mozglue.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M1 2023-02-22 |
rev 1 |
2023-02-22 |
| snort |
ET INFO Clearbit Logo Query in DNS Lookup |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M4 2023-02-22 |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for sqlite3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for msvcp40.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M2 2023-02-22 |
rev 1 |
2023-02-22 |