| suricata |
ET PHISHING Successful Generic Credential Phish M4 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M1 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M2 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M3 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for msvcp40.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| sigma |
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load |
test |
2023-02-22 |
| sigma |
HackTool - Jlaive In-Memory Assembly Execution |
test |
2023-02-22 |
| sigma |
Potential Persistence Via Outlook Form |
test |
2023-02-22 |
| sigma |
Audit Policy Tampering Via Auditpol |
test |
2023-02-22 |
| sigma |
Office Macro File Creation From Suspicious Process |
test |
2023-02-22 |
| sigma |
System Drawing DLL Load |
test |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2023-02-22 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-02-21 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS TA399/SideWinder Credential Phish Landing Page M1 2023-02-16 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M1 2023-02-22 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M2 2023-02-22 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2023-02-22 |
rev 1 |
2023-02-21 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-02-21 |
rev 1 |
2023-02-21 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page M1 2023-02-22 |
rev 1 |
2023-02-21 |
| suricata |
ET PHISHING TA399/SideWinder Credential Phish Landing Page M1 2023-02-16 |
rev 1 |
2023-02-21 |
| sigma |
PUA - Mouse Lock Execution |
test |
2023-02-21 |
| sigma |
PUA - AdvancedRun Suspicious Execution |
test |
2023-02-21 |
| sigma |
PUA - AdvancedRun Execution |
test |
2023-02-21 |
| sigma |
Windows Admin Share Mount Via Net.EXE |
test |
2023-02-21 |
| sigma |
Windows Share Mount Via Net.EXE |
test |
2023-02-21 |
| sigma |
Data Copied To Clipboard Via Clip.EXE |
test |
2023-02-21 |
| sigma |
HackTool - CrackMapExec PowerShell Obfuscation |
test |
2023-02-21 |
| sigma |
HackTool - Covenant PowerShell Launcher |
test |
2023-02-21 |
| sigma |
PUA - CsExec Execution |
test |
2023-02-21 |
| sigma |
PUA - DIT Snapshot Viewer |
test |
2023-02-21 |
| sigma |
System Network Connections Discovery Via Net.EXE |
test |
2023-02-21 |
| sigma |
Password Provided In Command Line Of Net.EXE |
test |
2023-02-21 |
| sigma |
New User Created Via Net.EXE |
test |
2023-02-21 |
| sigma |
New User Created Via Net.EXE With Never Expire Option |
test |
2023-02-21 |