| suricata |
ET INFO RustDesk Relay Domain in DNS Lookup |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Get Software Update URL |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE Kakfum/COLDSTEEL CnC Beacon M3 |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE UAC-0114/Winter Vivern CnC Activity |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE UAC-0114/Winter Vivern Screenshot Upload M2 |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE UAC-0114/Winter Vivern File Exfilration |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Register Peer where serial=1 |
rev 1 |
2023-02-02 |
| sigma |
OneNote.EXE Execution of Malicious Embedded Scripts |
test |
2023-02-02 |
| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - CLI |
test |
2023-02-02 |
| sigma |
Domain Trust Discovery Via Dsquery |
test |
2023-02-02 |
| snort |
ET CURRENT_EVENTS Successful Metamask Pass Phrase Phish 2023-02-01 |
rev 1 |
2023-02-01 |
| suricata |
ET PHISHING Successful Metamask Pass Phrase Phish 2023-02-01 |
rev 1 |
2023-02-01 |
| sigma |
ConvertTo-SecureString Cmdlet Usage Via CommandLine |
test |
2023-02-01 |
| sigma |
Java Running with Remote Debugging |
test |
2023-02-01 |
| snort |
ET MALWARE BoostBeast Task Request M2 |
rev 1 |
2023-01-31 |
| snort |
ET TROJAN GCleaner Downloader - Payload Response |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Task Response |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Checkin M1 |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Task Request M1 |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Checkin M2 |
rev 1 |
2023-01-31 |
| snort |
ET CURRENT_EVENTS Successful VyStar CU Credential Phish 2023-01-31 |
rev 1 |
2023-01-31 |
| snort |
ET TROJAN DeimosC2 TCP Agent Heartbeat |
rev 2 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Task Request M1 |
rev 1 |
2023-01-31 |
| suricata |
ET PHISHING Successful VyStar CU Credential Phish 2023-01-31 |
rev 1 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Checkin M2 |
rev 1 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Task Request M2 |
rev 1 |
2023-01-31 |
| suricata |
ET MALWARE DeimosC2 TCP Agent Heartbeat |
rev 2 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Task Response |
rev 1 |
2023-01-31 |
| sigma |
OSACompile Run-Only Execution |
test |
2023-01-31 |
| sigma |
Copy Passwd Or Shadow From TMP Path |
test |
2023-01-31 |
| sigma |
JXA In-memory Execution Via OSAScript |
test |
2023-01-31 |
| sigma |
Unsigned AppX Installation Attempt Using Add-AppxPackage |
test |
2023-01-31 |
| sigma |
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript |
test |
2023-01-31 |
| snort |
ET CURRENT_EVENTS Successful AU myGov Credential Phish 2023-01-30 |
rev 1 |
2023-01-30 |
| snort |
ET INFO Request for PDF via PowerShell |
rev 1 |
2023-01-30 |
| suricata |
ET INFO Request for PDF via PowerShell |
rev 1 |
2023-01-30 |
| suricata |
ET PHISHING Successful AU myGov Credential Phish 2023-01-30 |
rev 1 |
2023-01-30 |
| sigma |
Powershell Base64 Encoded MpPreference Cmdlet |
test |
2023-01-30 |
| sigma |
PowerShell Base64 Encoded Reflective Assembly Load |
test |
2023-01-30 |