| suricata |
ET PHISHING Successful Wallet Connect Key Store Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| suricata |
ET PHISHING Successful Wallet Connect Private Key Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| sigma |
Renamed Remote Utilities RAT (RURAT) Execution |
test |
2023-02-03 |
| sigma |
Potential Renamed Rundll32 Execution |
test |
2023-02-03 |
| sigma |
Potential Ryuk Ransomware Activity |
stable |
2023-02-03 |
| sigma |
Renamed Plink Execution |
test |
2023-02-03 |
| sigma |
Potential Manage-bde.wsf Abuse To Proxy Execution |
test |
2023-02-03 |
| sigma |
Potential QBot Activity |
stable |
2023-02-03 |
| sigma |
Potential Process Injection Via Msra.EXE |
test |
2023-02-03 |
| sigma |
Uncommon One Time Only Scheduled Task At 00:00 |
test |
2023-02-03 |
| sigma |
Potential AMSI Bypass Via .NET Reflection |
test |
2023-02-03 |
| sigma |
Potential Persistence Via Powershell Search Order Hijacking - Task |
test |
2023-02-03 |
| sigma |
Microsoft Workflow Compiler Execution |
test |
2023-02-03 |
| sigma |
Potential CVE-2022-26809 Exploitation Attempt |
test |
2023-02-03 |
| sigma |
Potential PlugX Activity |
test |
2023-02-03 |
| sigma |
LockerGoga Ransomware Activity |
stable |
2023-02-03 |
| sigma |
Renamed BrowserCore.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed Vmnat.exe Execution |
test |
2023-02-03 |
| sigma |
Potential Dridex Activity |
stable |
2023-02-03 |
| sigma |
Renamed MegaSync Execution |
test |
2023-02-03 |
| sigma |
Renamed FTP.EXE Execution |
test |
2023-02-03 |
| sigma |
Nltest.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed Msdt.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed Jusched.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed Mavinject.EXE Execution |
test |
2023-02-03 |
| sigma |
Potential Arbitrary Code Execution Via Node.EXE |
test |
2023-02-03 |
| snort |
ET TROJAN UAC-0114/Winter Vivern File Exfilration |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Check NAT Type |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN UAC-0114/Winter Vivern CnC Activity |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN UAC-0114/Winter Vivern Screenshot Upload M1 |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN Kakfum/COLDSTEEL CnC Beacon M3 |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN UAC-0114/Winter Vivern Screenshot Upload M2 |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Register Public Key |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Register Peer where serial=1 |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Get Software Update URL |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Register Peer where serial=0 |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE UAC-0114/Winter Vivern Screenshot Upload M2 |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Register Peer where serial=1 |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Get Software Update URL |
rev 1 |
2023-02-02 |