| sigma |
HackTool - SharpLDAPmonitor Execution |
test |
2023-02-14 |
| sigma |
Process Creation Attempt via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Windows Hotfix Updates Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Renamed CreateDump Utility Execution |
test |
2023-02-14 |
| sigma |
Local Groups Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Hardware Model Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
HackTool - SharpEvtMute Execution |
test |
2023-02-14 |
| sigma |
Computer System Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
PUA - RunXCmd Execution |
test |
2023-02-14 |
| suricata |
ET MALWARE zgRAT / PureLogs CnC Activity M3 |
rev 1 |
2023-02-13 |
| snort |
ET INFO Observed Iperius Remote Domain in TLS SNI |
rev 1 |
2023-02-13 |
| snort |
ET INFO Observed Query to .beauty TLD |
rev 1 |
2023-02-13 |
| snort |
ET INFO Iperius Remote Related Domain in DNS Lookup |
rev 1 |
2023-02-13 |
| suricata |
ET HUNTING Observed Query to .beauty TLD |
rev 1 |
2023-02-13 |
| sigma |
HackTool - CrackMapExec Process Patterns |
test |
2023-02-13 |
| sigma |
HackTool - SILENTTRINITY Stager Execution |
test |
2023-02-13 |
| sigma |
HackTool - TruffleSnout Execution |
test |
2023-02-13 |
| sigma |
Sysmon Driver Unloaded Via Fltmc.EXE |
test |
2023-02-13 |
| sigma |
Firewall Disabled via Netsh.EXE |
test |
2023-02-13 |
| sigma |
RDP Port Forwarding Rule Added Via Netsh.EXE |
test |
2023-02-13 |
| sigma |
Harvesting Of Wifi Credentials Via Netsh.EXE |
test |
2023-02-13 |
| sigma |
Windows Firewall Disabled via PowerShell |
test |
2023-02-13 |
| sigma |
PUA - Chisel Tunneling Tool Execution |
test |
2023-02-13 |
| sigma |
PUA - NirCmd Execution |
test |
2023-02-13 |
| sigma |
PUA - NirCmd Execution As LOCAL SYSTEM |
test |
2023-02-13 |
| sigma |
PUA - NSudo Execution |
test |
2023-02-13 |
| sigma |
Potential Maze Ransomware Activity |
test |
2023-02-13 |
| sigma |
Potential CVE-2022-21587 Exploitation Attempt |
test |
2023-02-13 |
| sigma |
HackTool - SharpUp PrivEsc Tool Execution |
test |
2023-02-13 |
| sigma |
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location |
test |
2023-02-13 |
| sigma |
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension |
test |
2023-02-13 |
| sigma |
Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt |
test |
2023-02-13 |
| sigma |
New Network Trace Capture Started Via Netsh.EXE |
test |
2023-02-13 |
| sigma |
VeeamBackup Database Credentials Dump Via Sqlcmd.EXE |
test |
2023-02-13 |
| sigma |
Potential Crypto Mining Activity |
stable |
2023-02-13 |
| sigma |
HackTool - SharpImpersonation Execution |
test |
2023-02-13 |
| sigma |
HackTool - SharpChisel Execution |
test |
2023-02-13 |
| sigma |
HackTool - WinRM Access Via Evil-WinRM |
test |
2023-02-13 |
| sigma |
Potential Conti Ransomware Activity |
test |
2023-02-13 |
| sigma |
Suspicious SQL Error Messages |
test |
2023-02-12 |