| sigma |
Potential Network Sniffing Activity Using Network Tools |
test |
2023-02-20 |
| sigma |
New Service Creation Using PowerShell |
test |
2023-02-20 |
| sigma |
Invoke-Obfuscation CLIP+ Launcher - System |
test |
2023-02-20 |
| sigma |
Creation Of A Local User Account |
test |
2023-02-18 |
| sigma |
Suspicious Installer Package Child Process |
test |
2023-02-18 |
| sigma |
Guest Account Enabled Via Sysadminctl |
test |
2023-02-18 |
| sigma |
Potential Persistence Via PlistBuddy |
test |
2023-02-18 |
| snort |
ET CURRENT_EVENTS TA399/SideWinder Credential Phish Landing Page M2 2023-02-16 |
rev 1 |
2023-02-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.myftp .biz Domain |
rev 5 |
2023-02-17 |
| suricata |
ET PHISHING TA399/SideWinder Credential Phish Landing Page M2 2023-02-16 |
rev 1 |
2023-02-17 |
| sigma |
Binary Padding - MacOS |
test |
2023-02-17 |
| sigma |
Dynamic CSharp Compile Artefact |
test |
2023-02-17 |
| sigma |
Pingback Backdoor DLL Loading Activity |
test |
2023-02-17 |
| sigma |
Potential DLL Sideloading Via VMware Xfer |
test |
2023-02-17 |
| sigma |
Potential PrintNightmare Exploitation Attempt |
test |
2023-02-17 |
| sigma |
Suspicious Renamed Comsvcs DLL Loaded By Rundll32 |
test |
2023-02-17 |
| sigma |
Pingback Backdoor File Indicators |
test |
2023-02-17 |
| sigma |
DLL Loaded From Suspicious Location Via Cmspt.EXE |
test |
2023-02-17 |
| sigma |
HackTool - SILENTTRINITY Stager DLL Load |
test |
2023-02-17 |
| sigma |
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE |
test |
2023-02-17 |
| sigma |
Pingback Backdoor Activity |
test |
2023-02-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.apocalypto .org .uk domain |
rev 1 |
2023-02-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.apocalypto .org .uk domain |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.khabdha .org domain |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN Possible APT29 Compressed Payload Download Request |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN APT28 DealersChoice CnC Beacon Response |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN APT28 Zebrocy/Zekapab POST Template Structure |
rev 3 |
2023-02-16 |
| snort |
ET TROJAN APT28 Zebrocy/Zekapab CnC Checkin |
rev 2 |
2023-02-16 |
| snort |
ET CURRENT_EVENTS myGov Credential Phish 2023-02-15 |
rev 1 |
2023-02-16 |
| snort |
ET POLICY TLS possible TOR SSL traffic |
rev 3 |
2023-02-16 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.satelit .org domain |
rev 1 |
2023-02-16 |
| suricata |
ET PHISHING myGov Credential Phish 2023-02-15 |
rev 1 |
2023-02-16 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| elastic |
Google Workspace User Group Access Modified to Allow External Access |
deprecated |
2023-02-16 |
| sigma |
Tomcat WebServer Logs Deleted |
test |
2023-02-16 |