| snort |
ET INFO DigitalSize DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO AhaDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO Charter DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO CZ.NIC DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO ControlId DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO DnsCrypt DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO DnsCrypt DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET TROJAN Bortzmeyer DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO Brahma World DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO Aaflalo .me DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO Artikel10 DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO Blokada DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO DNSPod DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| snort |
ET INFO Andrews & Arnold DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-10-18 |
| sigma |
PowerShell Script Change Permission Via Set-Acl |
test |
2022-10-18 |
| sigma |
PowerShell Set-Acl On Windows Folder |
test |
2022-10-18 |
| sigma |
Suspicious Service DACL Modification Via Set-Service Cmdlet |
test |
2022-10-18 |
| sigma |
Rclone Activity via Proxy |
test |
2022-10-18 |
| snort |
ET MOBILE_MALWARE Trojan-Ransom.AndroidOS.Agent.bi CnC Domain in DNS Lookup |
rev 1 |
2022-10-17 |
| snort |
ET TROJAN Win32/Kryptik.GSKY CnC Checkin |
rev 2 |
2022-10-17 |
| snort |
ET MOBILE_MALWARE Trojan-Ransom.AndroidOS.Agent.bi CnC Domain in DNS Lookup |
rev 1 |
2022-10-17 |
| suricata |
ET MALWARE Win32/Kryptik.GSKY CnC Checkin |
rev 2 |
2022-10-17 |
| sigma |
Possible Shadow Credentials Added |
test |
2022-10-17 |
| sigma |
Abuse of Service Permissions to Hide Services Via Set-Service - PS |
test |
2022-10-17 |
| sigma |
Abuse of Service Permissions to Hide Services Via Set-Service |
test |
2022-10-17 |
| sigma |
Payload Decoded and Decrypted via Built-in Utilities |
test |
2022-10-17 |
| sigma |
Potential WizardUpdate Malware Infection |
test |
2022-10-17 |
| sigma |
Potential XCSSET Malware Infection |
test |
2022-10-17 |
| sigma |
Possible DC Shadow Attack |
test |
2022-10-17 |
| snort |
ET TROJAN MSSQL maggie backdoor whoami Query Observed |
rev 2 |
2022-10-14 |
| snort |
ET TROJAN MSSQL maggie backdoor ListIP Query Observed |
rev 2 |
2022-10-14 |
| snort |
ET TROJAN MSSQL maggie backdoor sysinfo Query Observed |
rev 2 |
2022-10-14 |
| snort |
ET TROJAN Win32/TrojanDropper.Agent.SSQ Checkin |
rev 1 |
2022-10-14 |
| suricata |
ET MALWARE MSSQL maggie backdoor sysinfo Query Observed |
rev 2 |
2022-10-14 |
| suricata |
ET MALWARE MSSQL maggie backdoor ListIP Query Observed |
rev 2 |
2022-10-14 |
| suricata |
ET MALWARE MSSQL maggie backdoor whoami Query Observed |
rev 2 |
2022-10-14 |
| sigma |
Replay Attack Detected |
test |
2022-10-14 |
| sigma |
Device Installation Blocked |
test |
2022-10-14 |
| sigma |
Add or Remove Computer from DC |
test |
2022-10-14 |
| sigma |
User Logoff Event |
test |
2022-10-14 |