| snort |
ET CURRENT_EVENTS Successful America First CU Credential Phish 2022-12-14 |
rev 1 |
2022-12-14 |
| snort |
ET CURRENT_EVENTS Successful Australian Government myGov Credential Phish 2022-12-14 |
rev 1 |
2022-12-14 |
| snort |
ET TROJAN Win32/Khaosz.A!MTB Checkin - Command Retrieval |
rev 1 |
2022-12-14 |
| snort |
ET TROJAN Win32/Sality.NBA Exfil |
rev 1 |
2022-12-14 |
| snort |
ET INFO SyncroMSP Remote Remote Management Software Install Checkin |
rev 1 |
2022-12-14 |
| snort |
ET INFO SyncroMSP Remote Remote Management Software Install Registration |
rev 1 |
2022-12-14 |
| snort |
ET TROJAN Filez Downloader Checkin |
rev 1 |
2022-12-14 |
| suricata |
ET MALWARE Win32/Khaosz.A!MTB Checkin - Command Retrieval |
rev 1 |
2022-12-14 |
| suricata |
ET INFO SyncroMSP Remote Remote Management Software Install Registration |
rev 1 |
2022-12-14 |
| suricata |
ET MALWARE Win32/Sality.NBA Exfil |
rev 1 |
2022-12-14 |
| suricata |
ET PHISHING Successful Australian Government myGov Credential Phish 2022-12-14 |
rev 1 |
2022-12-14 |
| suricata |
ET PHISHING Successful America First CU Credential Phish 2022-12-14 |
rev 1 |
2022-12-14 |
| sigma |
Potential DLL Sideloading Via JsSchHlp |
test |
2022-12-14 |
| sigma |
Potential Download/Upload Activity Using Type Command |
test |
2022-12-14 |
| snort |
ET TROJAN DOC/TrojanDownloader.Agent.ARJ Payload Request |
rev 1 |
2022-12-13 |
| snort |
ET TROJAN Villain C2 Framework HTTP Server Response |
rev 1 |
2022-12-13 |
| snort |
ET MALWARE Win32/SocksTroy Session Initiation Attempt M1 |
rev 1 |
2022-12-13 |
| snort |
ET MALWARE Win32/SocksTroy Session Initiation Attempt M2 |
rev 1 |
2022-12-13 |
| snort |
ET TROJAN Impersoni-fake-ator backdoor CnC Checkin |
rev 2 |
2022-12-13 |
| suricata |
ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M2 |
rev 4 |
2022-12-13 |
| suricata |
ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M2 |
rev 6 |
2022-12-13 |
| suricata |
ET HUNTING Possible COVID-19 Domain in SSL Certificate M1 |
rev 4 |
2022-12-13 |
| suricata |
ET MALWARE Impersoni-fake-ator backdoor CnC Checkin |
rev 2 |
2022-12-13 |
| suricata |
ET MALWARE DOC/TrojanDownloader.Agent.ARJ Payload Request |
rev 1 |
2022-12-13 |
| suricata |
ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2 |
rev 4 |
2022-12-13 |
| suricata |
ET MALWARE Win32/SocksTroy Session Initiation Attempt M1 |
rev 1 |
2022-12-13 |
| suricata |
ET MALWARE Win32/SocksTroy Session Initiation Attempt M2 |
rev 1 |
2022-12-13 |
| sigma |
Run Once Task Execution as Configured in Registry |
test |
2022-12-13 |
| sigma |
Potential DLL Sideloading Via ClassicExplorer32.dll |
test |
2022-12-13 |
| snort |
ET CURRENT_EVENTS Successful PostBank Credential Phish 2022-12-12 |
rev 1 |
2022-12-12 |
| snort |
ET TROJAN Win32/Valyria Maldoc Payload Request M2 |
rev 1 |
2022-12-12 |
| snort |
ET CURRENT_EVENTS Successful ING Banking Credential Phish 2022-12-12 |
rev 1 |
2022-12-12 |
| snort |
ET TROJAN Win32/Valyria Maldoc Payload Request M1 |
rev 1 |
2022-12-12 |
| snort |
ET CURRENT_EVENTS ING Banking Credential Phish Landing Page 2022-12-12 |
rev 1 |
2022-12-12 |
| suricata |
ET PHISHING Successful PostBank Credential Phish 2022-12-12 |
rev 1 |
2022-12-12 |
| snort |
ET TROJAN JS/GootLoader CnC Exfil |
rev 1 |
2022-12-09 |
| sigma |
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded |
test |
2022-12-09 |
| sigma |
Detection of PowerShell Execution via Sqlps.exe |
test |
2022-12-09 |
| sigma |
ETW Logging Tamper In .NET Processes Via CommandLine |
test |
2022-12-09 |
| sigma |
FoggyWeb Backdoor DLL Loading |
test |
2022-12-09 |