| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Telnet Opening - Successful CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Auth - Possilbe CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING Coinbase Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING ING Group Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| sigma |
Suspicious PowerShell Download - Powershell Script |
test |
2022-12-02 |
| sigma |
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script |
test |
2022-12-02 |
| sigma |
Time Travel Debugging Utility Usage - Image |
test |
2022-12-02 |
| sigma |
Adwind RAT / JRAT File Artifact |
test |
2022-12-02 |
| sigma |
Use Get-NetTCPConnection - PowerShell Module |
test |
2022-12-02 |
| sigma |
Detected Windows Software Discovery - PowerShell |
test |
2022-12-02 |
| sigma |
Wmiprvse Wbemcomn DLL Hijack - File |
test |
2022-12-02 |
| sigma |
Root Certificate Installed - PowerShell |
test |
2022-12-02 |
| sigma |
Clear PowerShell History - PowerShell |
test |
2022-12-02 |
| sigma |
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module |
test |
2022-12-02 |
| sigma |
Clear PowerShell History - PowerShell Module |
test |
2022-12-02 |
| sigma |
Suspicious Get Information for SMB Share - PowerShell Module |
test |
2022-12-02 |
| snort |
ET WEB_SERVER Likely Malicious Request for /proc/<pid>/smaps |
rev 1 |
2022-12-01 |
| snort |
ET INFO DNS Query for Suspicious .cf Domain |
rev 5 |
2022-12-01 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for User Details - Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |
| snort |
ET INFO Microsoft Connection Test |
rev 5 |
2022-12-01 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for Product Details Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |
| snort |
ET WEB_SERVER Likely Malicious Request for /proc/self/fd/ |
rev 2 |
2022-12-01 |
| snort |
ET INFO DNS Query for Suspicious .ga Domain |
rev 5 |
2022-12-01 |
| snort |
ET WEB_SERVER Likely Malicious Request for /proc/<pid>/cmdline |
rev 2 |
2022-12-01 |
| snort |
ET TROJAN Mustang Panda APT TONESHELL Related Activity |
rev 1 |
2022-12-01 |
| snort |
ET WEB_SERVER Likely Malicious Request for /proc/self/environ |
rev 4 |
2022-12-01 |
| snort |
ET INFO DNS Query for Suspicious .ml Domain |
rev 5 |
2022-12-01 |
| suricata |
ET WEB_SERVER Likely Malicious Request for /proc/self/environ |
rev 7 |
2022-12-01 |
| suricata |
ET INFO DNS Query for Suspicious .ga Domain |
rev 6 |
2022-12-01 |
| suricata |
ET INFO DNS Query for Suspicious .ml Domain |
rev 6 |
2022-12-01 |
| suricata |
ET INFO HTTP Request to a *.pw domain |
rev 16 |
2022-12-01 |
| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for User Details - Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |
| suricata |
ET MALWARE Possible Heliconia Noise Landing Page Response |
rev 1 |
2022-12-01 |
| suricata |
ET WEB_SERVER Likely Malicious Request for /proc/<pid>/cmdline |
rev 2 |
2022-12-01 |
| suricata |
ET WEB_SERVER Likely Malicious Request for /proc/<pid>/smaps |
rev 1 |
2022-12-01 |
| suricata |
ET INFO DNS Query for Suspicious .cf Domain |
rev 6 |
2022-12-01 |
| suricata |
ET MALWARE Mustang Panda APT TONESHELL Related Activity |
rev 1 |
2022-12-01 |
| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for Product Details Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |