| sigma |
Unusual Child Process of dns.exe |
test |
2023-02-05 |
| sigma |
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE |
test |
2023-02-05 |
| sigma |
Potential Discovery Activity Via Dnscmd.EXE |
test |
2023-02-04 |
| sigma |
Potential CVE-2021-40444 Exploitation Attempt |
test |
2023-02-04 |
| sigma |
Suspicious Outlook Child Process |
test |
2023-02-04 |
| sigma |
Potential Persistence Attempt Via Existing Service Tampering |
test |
2023-02-04 |
| sigma |
HackTool - SecurityXploded Execution |
stable |
2023-02-04 |
| sigma |
Scheduled Task Executing Encoded Payload from Registry |
test |
2023-02-04 |
| sigma |
HackTool - Hashcat Password Cracker Execution |
test |
2023-02-04 |
| sigma |
PUA - DefenderCheck Execution |
test |
2023-02-04 |
| sigma |
HackTool - SharPersist Execution |
test |
2023-02-04 |
| sigma |
Suspicious Microsoft Office Child Process - MacOS |
test |
2023-02-04 |
| sigma |
Potential DLL Sideloading Via DeviceEnroller.EXE |
test |
2023-02-04 |
| sigma |
PUA - Seatbelt Execution |
test |
2023-02-04 |
| sigma |
Potentially Over Permissive Permissions Granted Using Dsacls.EXE |
test |
2023-02-04 |
| sigma |
HackTool - SharpLdapWhoami Execution |
test |
2023-02-04 |
| sigma |
DirLister Execution |
test |
2023-02-04 |
| sigma |
Potential Password Spraying Attempt Using Dsacls.EXE |
test |
2023-02-04 |
| sigma |
HackTool - Hydra Password Bruteforce Execution |
test |
2023-02-04 |
| sigma |
HackTool - Htran/NATBypass Execution |
test |
2023-02-04 |
| sigma |
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE |
test |
2023-02-04 |
| sigma |
SafeBoot Registry Key Deleted Via Reg.EXE |
test |
2023-02-04 |
| sigma |
Service Registry Key Deleted Via Reg.EXE |
test |
2023-02-04 |
| sigma |
HackTool - ADCSPwn Execution |
test |
2023-02-04 |
| sigma |
HackTool - SafetyKatz Execution |
test |
2023-02-04 |
| sigma |
Potential Exploitation Attempt From Office Application |
test |
2023-02-04 |
| sigma |
Suspicious PowerShell Parent Process |
test |
2023-02-04 |
| sigma |
Suspicious Binary In User Directory Spawned From Office Application |
test |
2023-02-04 |
| sigma |
HackTool - PowerTool Execution |
test |
2023-02-04 |
| sigma |
HackTool - KrbRelayUp Execution |
test |
2023-02-04 |
| sigma |
HackTool - KrbRelay Execution |
test |
2023-02-04 |
| sigma |
Potential Emotet Activity |
stable |
2023-02-04 |
| sigma |
HackTool - DInjector PowerShell Cradle Execution |
test |
2023-02-04 |
| sigma |
Potential SystemNightmare Exploitation Attempt |
test |
2023-02-04 |
| sigma |
HackTool - Bloodhound/Sharphound Execution |
test |
2023-02-04 |
| snort |
ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 |
rev 2 |
2023-02-03 |
| snort |
ET CURRENT_EVENTS Successful Wallet Connect Private Key Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| snort |
ET CURRENT_EVENTS Successful Wallet Connect Pass Phrase Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| snort |
ET CURRENT_EVENTS Successful Wallet Connect Key Store Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| suricata |
ET PHISHING Successful Wallet Connect Pass Phrase Phish 2023-02-03 |
rev 1 |
2023-02-03 |