| sigma |
New User Created Via Net.EXE |
test |
2023-02-21 |
| sigma |
PUA - AdvancedRun Execution |
test |
2023-02-21 |
| sigma |
Windows Share Mount Via Net.EXE |
test |
2023-02-21 |
| sigma |
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE |
test |
2023-02-21 |
| sigma |
PUA - CsExec Execution |
test |
2023-02-21 |
| sigma |
System Network Connections Discovery Via Net.EXE |
test |
2023-02-21 |
| sigma |
Audit Policy Tampering Via NT Resource Kit Auditpol |
test |
2023-02-21 |
| sigma |
PUA - AdvancedRun Suspicious Execution |
test |
2023-02-21 |
| sigma |
HackTool - Covenant PowerShell Launcher |
test |
2023-02-21 |
| sigma |
HackTool - CrackMapExec PowerShell Obfuscation |
test |
2023-02-21 |
| sigma |
Data Copied To Clipboard Via Clip.EXE |
test |
2023-02-21 |
| sigma |
Suspicious Curl.EXE Download |
test |
2023-02-21 |
| sigma |
PUA - Adidnsdump Execution |
test |
2023-02-21 |
| sigma |
HackTool - Empire PowerShell Launch Parameters |
test |
2023-02-21 |
| sigma |
HackTool - Empire PowerShell UAC Bypass |
stable |
2023-02-21 |
| sigma |
Share And Session Enumeration Using Net.EXE |
stable |
2023-02-21 |
| sigma |
Deleted Data Overwritten Via Cipher.EXE |
test |
2023-02-21 |
| sigma |
Curl.EXE Execution |
test |
2023-02-21 |
| sigma |
File Download Via Curl.EXE |
test |
2023-02-21 |
| sigma |
Curl.EXE Execution With Custom UserAgent |
test |
2023-02-21 |
| snort |
ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy CnC Activity |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - FTP STOR Command M1 |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - FTP - Observed Creds |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - FTP STOR Command M2 |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - Machine ID Registration |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/Stealc Requesting browsers Config from C2 |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - Task Request |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/Stealc Requesting plugins Config from C2 |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - Key Material Upload |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - Task Request |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - Key Material Upload |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/Stealc Submitting Screenshot to C2 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/Stealc Submitting System Information to C2 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - FTP STOR Command M1 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - FTP - Observed Creds |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - FTP STOR Command M2 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - Machine ID Registration |
rev 1 |
2023-02-20 |
| sigma |
Potential Network Sniffing Activity Using Network Tools |
test |
2023-02-20 |