| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-09-23 |
rev 1 |
2022-09-23 |
| snort |
ET ATTACK_RESPONSE MalDoc/Generik.ILNMZZB Payload Inbound |
rev 1 |
2022-09-23 |
| snort |
ET CURRENT_EVENTS Successful Credential Phish M2 2022-09-23 |
rev 1 |
2022-09-23 |
| snort |
ET INFO SSH-2.0-Go version string Observed in Network Traffic |
rev 1 |
2022-09-23 |
| snort |
ET CURRENT_EVENTS Successful Credential Phish M1 2022-09-23 |
rev 1 |
2022-09-23 |
| snort |
ET ATTACK_RESPONSE JS/Spy.Banker.LD Credit Card Skimmer Inbound |
rev 1 |
2022-09-23 |
| snort |
ET CURRENT_EVENTS Successful Credential Phish M3 2022-09-23 |
rev 1 |
2022-09-23 |
| snort |
ET INFO SSH-2.0-Go version string Observed in Network Traffic |
rev 1 |
2022-09-23 |
| suricata |
ET ATTACK_RESPONSE JS/Spy.Banker.LD Credit Card Skimmer Inbound |
rev 1 |
2022-09-23 |
| suricata |
ET PHISHING Successful Credential Phish M1 2022-09-23 |
rev 1 |
2022-09-23 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2022-09-23 |
rev 1 |
2022-09-23 |
| suricata |
ET PHISHING Successful Credential Phish M2 2022-09-23 |
rev 1 |
2022-09-23 |
| suricata |
ET PHISHING Successful Credential Phish M3 2022-09-23 |
rev 1 |
2022-09-23 |
| suricata |
ET INFO SSH-2.0-Go version string Observed in Network Traffic |
rev 1 |
2022-09-23 |
| suricata |
ET ATTACK_RESPONSE MalDoc/Generik.ILNMZZB Payload Inbound |
rev 1 |
2022-09-23 |
| suricata |
ET INFO SSH-2.0-Go version string Observed in Network Traffic |
rev 1 |
2022-09-23 |
| snort |
ET INFO Windows Commands and Variables in DNS Reply |
rev 1 |
2022-09-22 |
| snort |
ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt |
rev 1 |
2022-09-22 |
| suricata |
ET MALWARE Possible SombRAT Initial DNS Lookup |
rev 4 |
2022-09-22 |
| suricata |
ET HUNTING Windows Commands and Variables in DNS Reply |
rev 1 |
2022-09-22 |
| suricata |
ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt |
rev 1 |
2022-09-22 |
| sigma |
Impacket PsExec Execution |
test |
2022-09-22 |
| snort |
ET MALWARE Win/Malware.Filetour Variant Checkin M1 |
rev 3 |
2022-09-21 |
| sigma |
Suspicious Outbound SMTP Connections |
test |
2022-09-21 |
| sigma |
Use NTFS Short Name in Command Line |
test |
2022-09-21 |
| snort |
ET INFO Observed DNS Query to xsph .ru Domain |
rev 1 |
2022-09-20 |
| snort |
ET TROJAN BluStealer - SysInfo Exfil via Telegram M2 |
rev 1 |
2022-09-20 |
| suricata |
ET INFO Observed DNS Query to xsph .ru Domain |
rev 1 |
2022-09-20 |
| snort |
ET INFO Office UA Retrieving Content on Unusually High Port |
rev 1 |
2022-09-19 |
| sigma |
SCM Database Privileged Operation |
test |
2022-09-18 |
| sigma |
Application Uninstalled |
test |
2022-09-17 |
| snort |
ET TROJAN Win32.Agent.Y!c CnC Checkin |
rev 1 |
2022-09-16 |
| sigma |
Suspicious Teams Application Related ObjectAcess Event |
test |
2022-09-16 |
| sigma |
CobaltStrike Load by Rundll32 |
test |
2022-09-16 |
| sigma |
Indicator Removal on Host - Clear Mac System Logs |
test |
2022-09-16 |
| snort |
ET TROJAN ValleyRAT CnC Checkin Server Response |
rev 1 |
2022-09-15 |
| suricata |
ET MALWARE ValleyRAT CnC Checkin Server Response |
rev 1 |
2022-09-15 |
| sigma |
Print History File Contents |
test |
2022-09-15 |
| sigma |
History File Deletion |
test |
2022-09-15 |
| sigma |
Suspicious Curl Change User Agents - Linux |
test |
2022-09-15 |