| sigma |
DNS HybridConnectionManager Service Bus |
test |
2023-01-16 |
| sigma |
DNS Query for Anonfiles.com Domain - DNS Client |
test |
2023-01-16 |
| sigma |
Suspicious Cobalt Strike DNS Beaconing - DNS Client |
test |
2023-01-16 |
| sigma |
DNS Query To MEGA Hosting Website - DNS Client |
test |
2023-01-16 |
| sigma |
Suspicious Digital Signature Of AppX Package |
test |
2023-01-16 |
| sigma |
DNS Query for Anonfiles.com Domain - Sysmon |
test |
2023-01-16 |
| sigma |
Suspicious Cobalt Strike DNS Beaconing - Sysmon |
test |
2023-01-16 |
| sigma |
Potential Data Exfiltration Via Audio File |
test |
2023-01-16 |
| sigma |
Root Certificate Installed From Susp Locations |
test |
2023-01-16 |
| sigma |
Malicious Nishang PowerShell Commandlets |
test |
2023-01-16 |
| snort |
ET TROJAN Win32/Spy.KeyLogger.RJA Checkin |
rev 1 |
2023-01-13 |
| snort |
ET TROJAN Win32/Gamaredon CnC Activity |
rev 1 |
2023-01-13 |
| suricata |
ET MALWARE Win32/Spy.KeyLogger.RJA Checkin |
rev 1 |
2023-01-13 |
| snort |
ET TROJAN DCRAT Checkin via Telegram |
rev 1 |
2023-01-12 |
| sigma |
Potential Malicious AppX Package Installation Attempts |
test |
2023-01-12 |
| sigma |
Restricted Software Access By SRP |
test |
2023-01-12 |
| sigma |
Mount Execution With Hidepid Parameter |
test |
2023-01-12 |
| snort |
ET TROJAN Win32/Nitol.A CnC Checkin M3 |
rev 1 |
2023-01-11 |
| snort |
ET CURRENT_EVENTS Manhattan College Phish Landing Page 2022-01-10 |
rev 1 |
2023-01-11 |
| snort |
ET CURRENT_EVENTS Successful Manhattan College Credential Phish 2022-01-10 |
rev 1 |
2023-01-11 |
| sigma |
Potential Signing Bypass Via Windows Developer Features |
test |
2023-01-11 |
| sigma |
Deployment Of The AppX Package Was Blocked By The Policy |
test |
2023-01-11 |
| sigma |
Deployment AppX Package Was Blocked By AppLocker |
test |
2023-01-11 |
| sigma |
Potential PowerShell Execution Policy Tampering - ProcCreation |
test |
2023-01-11 |
| sigma |
AppX Located in Known Staging Directory Added to Deployment Pipeline |
test |
2023-01-11 |
| sigma |
Touch Suspicious Service File |
test |
2023-01-11 |
| snort |
ET TROJAN XDR33 CnC Server SSL Certificate Observed |
rev 1 |
2023-01-10 |
| suricata |
ET MALWARE XDR33 CnC Server SSL Certificate Observed |
rev 1 |
2023-01-10 |
| sigma |
Import PowerShell Modules From Suspicious Directories - ProcCreation |
test |
2023-01-10 |
| sigma |
Suspicious Git Clone |
test |
2023-01-10 |
| sigma |
Import PowerShell Modules From Suspicious Directories |
test |
2023-01-10 |
| snort |
ET TROJAN WinPwn PenTesting Activity |
rev 1 |
2023-01-09 |
| snort |
ET POLICY Http Client Body contains upin= in cleartext |
rev 1 |
2023-01-09 |
| snort |
ET CURRENT_EVENTS Generic Korean Bank Credential Theft 2023-01-09 |
rev 1 |
2023-01-09 |
| sigma |
Potential PowerShell Obfuscation Using Character Join |
test |
2023-01-09 |
| sigma |
Cisco LDP Authentication Failures |
test |
2023-01-09 |
| sigma |
Potential DLL Injection Or Execution Using Tracker.exe |
test |
2023-01-09 |
| snort |
ET MALWARE Redline Stealer TCP CnC - Id1Response |
rev 1 |
2023-01-06 |
| snort |
ET TROJAN O97M/Sadoca.C!ml Checkin |
rev 1 |
2023-01-06 |
| snort |
ET TROJAN Remote Utility Access Tool Key SMTP Exfil |
rev 1 |
2023-01-06 |