| sigma |
Remove Immutable File Attribute - Auditd |
test |
2022-11-26 |
| sigma |
Commands to Clear or Remove the Syslog - Builtin |
test |
2022-11-26 |
| sigma |
System Shutdown/Reboot - Linux |
test |
2022-11-26 |
| sigma |
Disabling Security Tools - Builtin |
test |
2022-11-26 |
| sigma |
System and Hardware Information Discovery |
stable |
2022-11-26 |
| sigma |
Clipboard Collection with Xclip Tool - Auditd |
test |
2022-11-26 |
| sigma |
File and Directory Discovery - MacOS |
test |
2022-11-25 |
| sigma |
WMIC Unquoted Services Path Lookup - PowerShell |
test |
2022-11-25 |
| snort |
ET CURRENT_EVENTS WalletConnect Stealer Landing Page 2022-11-23 |
rev 1 |
2022-11-23 |
| snort |
ET CURRENT_EVENTS Successful Credit Agricole Credential Phish 2022-11-23 |
rev 1 |
2022-11-23 |
| snort |
ET CURRENT_EVENTS Successful BT GROUP Credential Phish 2022-11-23 |
rev 1 |
2022-11-23 |
| suricata |
ET PHISHING WalletConnect Stealer Landing Page 2022-11-23 |
rev 1 |
2022-11-23 |
| suricata |
ET PHISHING Successful Credit Agricole Credential Phish 2022-11-23 |
rev 1 |
2022-11-23 |
| suricata |
ET PHISHING Successful BT GROUP Credential Phish 2022-11-23 |
rev 1 |
2022-11-23 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2022-11-22 |
rev 1 |
2022-11-22 |
| snort |
ET CURRENT_EVENTS Ulpian Credential Phish Landing Page 2022-11-22 |
rev 1 |
2022-11-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential OTP Phish 2022-11-22 |
rev 1 |
2022-11-22 |
| suricata |
ET PHISHING Successful Generic Credential OTP Phish 2022-11-22 |
rev 1 |
2022-11-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish 2022-11-22 |
rev 1 |
2022-11-22 |
| suricata |
ET PHISHING Ulpian Credential Phish Landing Page 2022-11-22 |
rev 1 |
2022-11-22 |
| sigma |
UAC Bypass Using Event Viewer RecentViews |
test |
2022-11-22 |
| sigma |
UAC Bypass Using EventVwr |
test |
2022-11-22 |
| snort |
ET INFO Observed DNS Query to .biz TLD |
rev 3 |
2022-11-21 |
| snort |
ET INFO Observed DNS Query to .work TLD |
rev 3 |
2022-11-21 |
| snort |
ET WEB_SERVER HTTP Request to a *.33db9538.com domain - Anuna Checkin - Compromised PHP Site |
rev 2 |
2022-11-21 |
| snort |
ET WEB_SERVER HTTP Request to a *.54dfa1cb.com domain - Anuna Checkin - Compromised PHP Site |
rev 2 |
2022-11-21 |
| snort |
ET INFO Dotted Quad Host DOC Request |
rev 4 |
2022-11-21 |
| snort |
ET INFO infinityfree .net Domain in DNS Lookup |
rev 3 |
2022-11-21 |
| snort |
ET INFO Redirect Link in TikTok URL |
rev 1 |
2022-11-21 |
| snort |
ET INFO HTTP Request to Suspicious *.life Domain |
rev 3 |
2022-11-21 |
| snort |
ET INFO Observed DNS Query to .fit TLD |
rev 3 |
2022-11-21 |
| snort |
ET TROJAN ProjectSauron Remsec/HTTPBrowser/Pisloader Covert DNS CnC Channel TXT Lookup |
rev 6 |
2022-11-21 |
| snort |
ET TROJAN Golang Aurora Stealer Exfil Activity |
rev 1 |
2022-11-21 |
| snort |
ET INFO HTTP Request to Suspicious *.world Domain |
rev 3 |
2022-11-21 |
| snort |
ET INFO Observed DNS Query to .world TLD |
rev 3 |
2022-11-21 |
| snort |
ET INFO Observed DNS Query to .okinawa TLD |
rev 3 |
2022-11-21 |
| snort |
ET INFO HTTP Request to Suspicious *.work Domain |
rev 3 |
2022-11-21 |
| snort |
ET TROJAN Win32/Filecoder.OJC CnC Checkin |
rev 1 |
2022-11-21 |
| snort |
ET INFO Dotted Quad Host PDF Request |
rev 4 |
2022-11-21 |
| snort |
ET INFO Unconfigured nginx Access |
rev 2 |
2022-11-21 |