| sigma |
Registry Modification Via Regini.EXE |
test |
2023-02-08 |
| sigma |
GatherNetworkInfo.VBS Reconnaissance Script Output |
test |
2023-02-08 |
| sigma |
Suspicious Outlook Macro Created |
test |
2023-02-08 |
| sigma |
HackTool - XORDump Execution |
test |
2023-02-08 |
| sigma |
Suspicious Registry Modification From ADS Via Regini.EXE |
test |
2023-02-08 |
| sigma |
PUA - Netcat Suspicious Execution |
test |
2023-02-08 |
| snort |
ET TROJAN Win32/Disabler.NPR Checkin |
rev 1 |
2023-02-07 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2023-02-07 |
rev 1 |
2023-02-07 |
| suricata |
ET MALWARE Win32/Disabler.NPR Checkin |
rev 1 |
2023-02-07 |
| suricata |
ET PHISHING Successful Generic Credential Phish 2023-02-07 |
rev 1 |
2023-02-07 |
| sigma |
Renamed AutoHotkey.EXE Execution |
test |
2023-02-07 |
| sigma |
Scheduled Task Executed From A Suspicious Location |
test |
2023-02-07 |
| sigma |
Scheduled Task Executed Uncommon LOLBIN |
test |
2023-02-07 |
| sigma |
Potential LethalHTA Technique Execution |
test |
2023-02-07 |
| sigma |
Suspicious JavaScript Execution Via Mshta.EXE |
test |
2023-02-07 |
| sigma |
HackTool - Impacket Tools Execution |
test |
2023-02-07 |
| sigma |
PUA - Advanced IP Scanner Execution |
test |
2023-02-07 |
| sigma |
PUA - Advanced Port Scanner Execution |
test |
2023-02-07 |
| sigma |
Potential CVE-2021-26857 Exploitation Attempt |
stable |
2023-02-07 |
| sigma |
Potential Persistence Via Disk Cleanup Handler - Registry |
test |
2023-02-07 |
| snort |
ET TROJAN Win32/Spy.Banker.AAGB Checkin |
rev 1 |
2023-02-06 |
| snort |
ET TROJAN Win32/Comrerop Checkin |
rev 1 |
2023-02-06 |
| snort |
ET INFO Ex Libris Library Software DNS Lookup |
rev 1 |
2023-02-06 |
| snort |
ET INFO Possible SMTP Data Exfiltration - File Attachment Named Files.zip |
rev 1 |
2023-02-06 |
| suricata |
ET MALWARE Win32/Spy.Banker.AAGB Checkin |
rev 1 |
2023-02-06 |
| suricata |
ET INFO Ex Libris Library Software DNS Lookup |
rev 1 |
2023-02-06 |
| suricata |
ET MALWARE Win32/Comrerop Checkin |
rev 1 |
2023-02-06 |
| suricata |
ET INFO Possible SMTP Data Exfiltration - File Attachment Named Files.zip |
rev 1 |
2023-02-06 |
| sigma |
Remotely Hosted HTA File Executed Via Mshta.EXE |
test |
2023-02-06 |
| sigma |
Suspicious MSDT Parent Process |
test |
2023-02-06 |
| sigma |
Suspicious MSHTA Child Process |
test |
2023-02-06 |
| sigma |
HackTool - PurpleSharp Execution |
test |
2023-02-05 |
| sigma |
Potential Meterpreter/CobaltStrike Activity |
test |
2023-02-05 |
| sigma |
Files Added To An Archive Using Rar.EXE |
test |
2023-02-05 |
| sigma |
Potential Suspicious Registry File Imported Via Reg.EXE |
test |
2023-02-05 |
| sigma |
HackTool - Pypykatz Credentials Dumping Activity |
test |
2023-02-05 |
| sigma |
DNS Server Error Failed Loading the ServerLevelPluginDLL |
test |
2023-02-05 |
| sigma |
Potential MSTSC Shadowing Activity |
test |
2023-02-05 |
| sigma |
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE |
test |
2023-02-05 |
| sigma |
Unusual Child Process of dns.exe |
test |
2023-02-05 |