| sigma |
Suspicious XOR Encoded PowerShell Command |
test |
2023-01-30 |
| sigma |
PDQ Deploy Remote Adminstartion Tool Execution |
test |
2023-01-30 |
| sigma |
PowerShell Base64 Encoded WMI Classes |
test |
2023-01-30 |
| sigma |
Operator Bloopers Cobalt Strike Modules |
test |
2023-01-30 |
| sigma |
Suspicious Svchost Process Access |
test |
2023-01-30 |
| sigma |
Operator Bloopers Cobalt Strike Commands |
test |
2023-01-30 |
| sigma |
New Github Organization Member Added |
test |
2023-01-29 |
| sigma |
Outdated Dependency Or Vulnerability Alert Disabled |
test |
2023-01-27 |
| sigma |
Github Self Hosted Runner Changes Detected |
test |
2023-01-27 |
| sigma |
Potential RDP Tunneling Via Plink |
test |
2023-01-27 |
| snort |
ET INFO Suspected Impacket WMIExec Activity |
rev 1 |
2023-01-26 |
| suricata |
ET INFO Suspected Impacket WMIExec Activity |
rev 1 |
2023-01-26 |
| sigma |
Hiding User Account Via SpecialAccounts Registry Key |
test |
2023-01-26 |
| sigma |
Potential BearLPE Exploitation |
test |
2023-01-26 |
| sigma |
Base64 Encoded PowerShell Command Detected |
test |
2023-01-26 |
| sigma |
Potential Encoded PowerShell Patterns In CommandLine |
test |
2023-01-26 |
| snort |
ET CURRENT_EVENTS Successful Banco G&T Continental Credential Phish 2023-01-25 |
rev 1 |
2023-01-25 |
| suricata |
ET PHISHING Successful Banco G&T Continental Credential Phish 2023-01-25 |
rev 1 |
2023-01-25 |
| sigma |
Potential Suspicious BPF Activity - Linux |
test |
2023-01-25 |
| sigma |
Potential RDP Tunneling Via SSH |
test |
2023-01-25 |
| sigma |
Terminal Service Process Spawn |
test |
2023-01-25 |
| sigma |
Enable BPF Kprobes Tracing |
test |
2023-01-25 |
| snort |
ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M2 |
rev 1 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET TROJAN SLIVER Framework SMB CreateService Default ServiceName |
rev 1 |
2023-01-24 |
| snort |
ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M8 |
rev 1 |
2023-01-24 |
| snort |
ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M7 |
rev 1 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M6 |
rev 1 |
2023-01-24 |
| snort |
ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M3 |
rev 1 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |