| snort |
ET TROJAN Redline Stealer TCP CnC Activity |
rev 1 |
2023-01-06 |
| suricata |
ET MALWARE Remote Utility Access Tool Key SMTP Exfil |
rev 1 |
2023-01-06 |
| suricata |
ET MALWARE Redline Stealer TCP CnC - Id1Response |
rev 2 |
2023-01-06 |
| sigma |
PowerShell SAM Copy |
test |
2023-01-06 |
| sigma |
Suspicious Use of /dev/tcp |
test |
2023-01-06 |
| sigma |
VsCode Powershell Profile Modification |
test |
2023-01-06 |
| snort |
ET TROJAN AHK Bot Domain Profiler CnC Activity |
rev 1 |
2023-01-05 |
| sigma |
Potential RipZip Attack on Startup Folder |
test |
2023-01-05 |
| sigma |
Potential SAM Database Dump |
test |
2023-01-05 |
| sigma |
Suspicious PowerShell Invocations - Specific - ProcessCreation |
test |
2023-01-05 |
| sigma |
Potential Winnti Dropper Activity |
test |
2023-01-05 |
| sigma |
Malicious Base64 Encoded PowerShell Keywords in Command Lines |
test |
2023-01-05 |
| sigma |
Suspicious PowerShell Encoded Command Patterns |
test |
2023-01-05 |
| sigma |
Suspicious Execution of Powershell with Base64 |
test |
2023-01-05 |
| sigma |
PowerShell Get-Process LSASS |
test |
2023-01-05 |
| sigma |
Suspicious Creation with Colorcpl |
test |
2023-01-05 |
| sigma |
Suspicious Git Clone - Linux |
test |
2023-01-05 |
| sigma |
Suspicious PowerShell Invocation From Script Engines |
test |
2023-01-05 |
| sigma |
Potential Persistence Via Security Descriptors - ScriptBlock |
test |
2023-01-05 |
| sigma |
NTDS.DIT Creation By Uncommon Parent Process |
test |
2023-01-05 |
| sigma |
Net WebClient Casing Anomalies |
test |
2023-01-05 |
| snort |
ET TROJAN Win32/Aurora Stealer Sending System Information |
rev 1 |
2023-01-04 |
| suricata |
ET MALWARE Win32/Aurora Stealer Sending System Information |
rev 1 |
2023-01-04 |
| sigma |
Cisco Discovery |
test |
2023-01-04 |
| sigma |
Cisco Denial of Service |
test |
2023-01-04 |
| sigma |
Cisco Stage Data |
test |
2023-01-04 |
| sigma |
Cisco Local Accounts |
test |
2023-01-04 |
| sigma |
Cisco Show Commands Input |
test |
2023-01-04 |
| sigma |
Cisco Sniffing |
test |
2023-01-04 |
| sigma |
Cisco File Deletion |
test |
2023-01-04 |
| sigma |
Potential Keylogger Activity |
test |
2023-01-04 |
| sigma |
Cisco Disabling Logging |
test |
2023-01-04 |
| sigma |
Cisco Collect Data |
test |
2023-01-04 |
| sigma |
Cisco Crypto Commands |
test |
2023-01-04 |
| sigma |
Invoke-Obfuscation Via Use MSHTA - PowerShell Module |
test |
2023-01-04 |
| sigma |
Win Susp Computer Name Containing Samtheadmin |
test |
2023-01-04 |
| sigma |
Potential PowerShell Downgrade Attack |
test |
2023-01-04 |
| sigma |
Service Installed By Unusual Client - Security |
test |
2023-01-04 |
| sigma |
Service Installed By Unusual Client - System |
test |
2023-01-04 |
| sigma |
Space After Filename - macOS |
test |
2023-01-04 |