| snort |
ET TROJAN Winter Vivern Retrieving Commands |
rev 2 |
2023-02-15 |
| snort |
ET TROJAN OSX/iWebUpdate CnC Activity |
rev 1 |
2023-02-15 |
| suricata |
ET MALWARE OSX/iWebUpdate CnC Activity |
rev 1 |
2023-02-15 |
| sigma |
Unusual File Deletion by Dns.exe |
test |
2023-02-15 |
| sigma |
File Deleted Via Sysinternals SDelete |
test |
2023-02-15 |
| sigma |
TeamViewer Log File Deleted |
test |
2023-02-15 |
| sigma |
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE |
test |
2023-02-15 |
| sigma |
File Download Via Bitsadmin |
test |
2023-02-15 |
| sigma |
Backup Files Deleted |
test |
2023-02-15 |
| sigma |
Boot Configuration Tampering Via Bcdedit.EXE |
stable |
2023-02-15 |
| sigma |
EventLog EVTX File Deleted |
test |
2023-02-15 |
| sigma |
IIS WebServer Access Logs Deleted |
test |
2023-02-15 |
| sigma |
PowerShell Console History Logs Deleted |
test |
2023-02-15 |
| sigma |
Suspicious Download From Direct IP Via Bitsadmin |
test |
2023-02-15 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET HUNTING Suspicious Windows Executable WriteProcessMemory |
rev 6 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| sigma |
Suspicious WindowsTerminal Child Processes |
test |
2023-02-14 |
| sigma |
Renamed SysInternals DebugView Execution |
test |
2023-02-14 |
| sigma |
PUA - CleanWipe Execution |
test |
2023-02-14 |
| sigma |
HackTool - SharpLDAPmonitor Execution |
test |
2023-02-14 |
| sigma |
HackTool - SharpView Execution |
test |
2023-02-14 |
| sigma |
PUA - RunXCmd Execution |
test |
2023-02-14 |
| sigma |
Suspicious Obfuscated PowerShell Code |
test |
2023-02-14 |
| sigma |
PUA - WebBrowserPassView Execution |
test |
2023-02-14 |
| sigma |
Process Creation Attempt via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Potential SMB Relay Attack Tool Execution |
test |
2023-02-14 |
| sigma |
PUA - Wsudo Suspicious Execution |
test |
2023-02-14 |
| sigma |
Windows Binary Executed From WSL |
test |
2023-02-14 |
| sigma |
Service Started/Stopped Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Potential NTLM Coercion Via Certutil.EXE |
test |
2023-02-14 |
| sigma |
HackTool - SharpEvtMute Execution |
test |
2023-02-14 |