| sigma |
FoggyWeb Backdoor DLL Loading |
test |
2022-12-09 |
| snort |
ET TROJAN Win32/Packed.Themida.AAL Checkin |
rev 1 |
2022-12-08 |
| snort |
ET INFO Onion/TOR Proxy Client Request |
rev 3 |
2022-12-08 |
| sigma |
LSASS Process Dump Artefact In CrashDumps Folder |
test |
2022-12-08 |
| snort |
ET CURRENT_EVENTS Fifth Third Banking Credential Phish Landing Page 2022-12-07 |
rev 1 |
2022-12-07 |
| snort |
ET TROJAN GCleaner Downloader Activity M8 |
rev 1 |
2022-12-07 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-07 |
rev 1 |
2022-12-07 |
| suricata |
ET PHISHING Fifth Third Banking Credential Phish Landing Page 2022-12-07 |
rev 1 |
2022-12-07 |
| suricata |
ET MALWARE GCleaner Downloader Activity M8 |
rev 1 |
2022-12-07 |
| sigma |
Suspicious Scheduled Task Creation |
test |
2022-12-07 |
| sigma |
Windows Defender AMSI Trigger Detected |
stable |
2022-12-07 |
| snort |
ET MALWARE Win32/Adware.Neoreklami.MI Activity M1 |
rev 1 |
2022-12-06 |
| snort |
ET MALWARE Win32/Adware.Neoreklami.MI Activity M2 |
rev 1 |
2022-12-06 |
| snort |
ET CURRENT_EVENTS iCloud Credential Phish Landing Page 2022-12-06 |
rev 1 |
2022-12-06 |
| snort |
ET INFO Chrome/0 in User-Agent |
rev 1 |
2022-12-06 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2022-12-06 |
rev 1 |
2022-12-06 |
| suricata |
ET PHISHING iCloud Credential Phish Landing Page 2022-12-06 |
rev 1 |
2022-12-06 |
| suricata |
ET HUNTING Chrome/0 in User-Agent |
rev 1 |
2022-12-06 |
| sigma |
Windows Defender Exclusions Added |
stable |
2022-12-06 |
| sigma |
Win Defender Restored Quarantine File |
test |
2022-12-06 |
| sigma |
Windows Defender Submit Sample Feature Disabled |
stable |
2022-12-06 |
| sigma |
Windows Defender Exploit Guard Tamper |
test |
2022-12-06 |
| sigma |
Microsoft Defender Tamper Protection Trigger |
stable |
2022-12-06 |
| sigma |
Registry Persistence Mechanisms in Recycle Bin |
test |
2022-12-06 |
| suricata |
ET MALWARE JS.ElectronBot Payload Inbound |
rev 1 |
2022-12-05 |
| sigma |
Suspicious Scheduled Task Update |
test |
2022-12-05 |
| sigma |
Mavinject Inject DLL Into Running Process |
test |
2022-12-05 |
| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 |
test |
2022-12-05 |
| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 |
test |
2022-12-05 |
| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 |
test |
2022-12-05 |
| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 |
test |
2022-12-05 |
| snort |
ET CURRENT_EVENTS ING Group Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| snort |
ET TROJAN Possible Heliconia Noise Landing Page Response |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - OpenTelnet Inbound - Possilbe CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Auth - Possilbe CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - RTSP Buffer Overflow Attempt - CVE-2022-26259 |
rev 1 |
2022-12-02 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| snort |
ET CURRENT_EVENTS Coinbase Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Telnet Opening - Successful CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |