| sigma |
WMI Persistence - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation STDIN+ Launcher - System |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation VAR+ Launcher - System |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation COMPRESS OBFUSCATION - System |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation RUNDLL LAUNCHER - System |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Stdin - System |
test |
2022-11-29 |
| snort |
ET INFO Suspected Phishing Simulation Service Activity |
rev 1 |
2022-11-28 |
| snort |
ET INFO IRC Nick change on non-standard port |
rev 17 |
2022-11-28 |
| suricata |
ET INFO Suspected Phishing Simulation Service Activity |
rev 1 |
2022-11-28 |
| sigma |
Suspicious PowerShell IEX Execution Patterns |
test |
2022-11-28 |
| sigma |
TacticalRMM Service Installation |
test |
2022-11-28 |
| sigma |
Potential PetitPotam Attack Via EFS RPC Calls |
test |
2022-11-28 |
| sigma |
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File |
test |
2022-11-28 |
| sigma |
Mesh Agent Service Installation |
test |
2022-11-28 |
| sigma |
Split A File Into Pieces - Linux |
test |
2022-11-28 |
| sigma |
File Time Attribute Change - Linux |
test |
2022-11-28 |
| sigma |
Suspicious History File Operations - Linux |
test |
2022-11-28 |
| sigma |
Operation Wocao Activity - Security |
test |
2022-11-27 |
| sigma |
Discovery Using AzureHound |
test |
2022-11-27 |
| sigma |
Scheduled Cron Task/Job - Linux |
test |
2022-11-27 |
| sigma |
CobaltStrike Service Installations - Security |
test |
2022-11-27 |
| sigma |
Security Software Discovery - MacOs |
test |
2022-11-27 |
| sigma |
Invoke-Obfuscation Obfuscated IEX Invocation - System |
test |
2022-11-27 |
| sigma |
Scheduled Cron Task/Job - MacOs |
test |
2022-11-27 |
| sigma |
MSExchange Transport Agent Installation - Builtin |
test |
2022-11-27 |
| sigma |
CobaltStrike Service Installations - System |
test |
2022-11-27 |
| sigma |
Security Software Discovery - Linux |
test |
2022-11-27 |
| sigma |
Invoke-Obfuscation Obfuscated IEX Invocation - Security |
test |
2022-11-27 |
| sigma |
Local Groups Discovery - MacOs |
test |
2022-11-27 |
| sigma |
Invoke-Obfuscation CLIP+ Launcher - Security |
test |
2022-11-27 |
| sigma |
HybridConnectionManager Service Installation - Registry |
test |
2022-11-27 |
| sigma |
Defrag Deactivation - Security |
test |
2022-11-27 |
| sigma |
Sticky Key Like Backdoor Usage - Registry |
test |
2022-11-26 |
| sigma |
RDP Sensitive Settings Changed to Zero |
test |
2022-11-26 |
| sigma |
Sudo Privilege Escalation CVE-2019-14287 - Builtin |
test |
2022-11-26 |
| sigma |
Remove Immutable File Attribute - Auditd |
test |
2022-11-26 |
| sigma |
Disabling Security Tools - Builtin |
test |
2022-11-26 |
| sigma |
Clipboard Collection with Xclip Tool - Auditd |
test |
2022-11-26 |
| sigma |
System and Hardware Information Discovery |
stable |
2022-11-26 |
| sigma |
System Shutdown/Reboot - Linux |
test |
2022-11-26 |