| snort |
ET TROJAN ErbiumStealer Response From Panel |
rev 1 |
2022-09-06 |
| snort |
ET TROJAN ErbiumStealer Response From CnC |
rev 1 |
2022-09-06 |
| suricata |
ET MALWARE ErbiumStealer Response From Panel |
rev 1 |
2022-09-06 |
| suricata |
ET PHISHING Suspicious CVV Parameter in HTTP POST - Possible Phishing |
rev 3 |
2022-09-06 |
| suricata |
ET MALWARE ErbiumStealer Response From CnC |
rev 1 |
2022-09-06 |
| sigma |
PowerShell ADRecon Execution |
test |
2022-09-06 |
| snort |
ET TROJAN PureCrypter Requesting Injector M1 |
rev 2 |
2022-09-03 |
| snort |
ET TROJAN PureCrypter Requesting Injector M2 |
rev 2 |
2022-09-03 |
| snort |
ET TROJAN Win32/Orchard Botnet Activity |
rev 1 |
2022-09-02 |
| snort |
ET TROJAN Win32/VictoryGate/Orchard Botnet CnC Checkin |
rev 1 |
2022-09-02 |
| snort |
ET TROJAN Win32/Sabsik.EN.D!ml CnC Checkin |
rev 1 |
2022-09-02 |
| suricata |
ET MALWARE Win32/Orchard Botnet Activity |
rev 1 |
2022-09-02 |
| suricata |
ET MALWARE Win32/VictoryGate/Orchard Botnet CnC Checkin |
rev 1 |
2022-09-02 |
| suricata |
ET MALWARE Win32/Sabsik.EN.D!ml CnC Checkin |
rev 1 |
2022-09-02 |
| sigma |
RDP over Reverse SSH Tunnel WFP |
test |
2022-09-02 |
| snort |
ET MALWARE ZeroTier P2P VPN Activity M1 |
rev 1 |
2022-09-01 |
| snort |
ET TROJAN Win32/Orchard Botnet Activity M2 |
rev 1 |
2022-09-01 |
| suricata |
ET ADWARE_PUP ZeroTier P2P VPN Activity M1 |
rev 1 |
2022-09-01 |
| suricata |
ET MALWARE Win32/Orchard Botnet Activity M2 |
rev 1 |
2022-09-01 |
| snort |
ET MALWARE Win32/ReImageRepair.T CnC Activity |
rev 1 |
2022-08-31 |
| sigma |
Suspicious Schtasks Schedule Type With High Privileges |
test |
2022-08-31 |
| snort |
ET TROJAN VBS/Kimsuky.O Host Fingerprint Exfil |
rev 1 |
2022-08-30 |
| snort |
ET TROJAN Win32/Caypnamer.A RAT CnC Keepalive |
rev 1 |
2022-08-30 |
| snort |
ET TROJAN Win32/Sabsik.FL.B!ml Exfil |
rev 1 |
2022-08-30 |
| suricata |
ET MALWARE Win32/Caypnamer.A RAT CnC Keepalive |
rev 1 |
2022-08-30 |
| sigma |
RTCore Suspicious Service Installation |
test |
2022-08-30 |
| sigma |
Bypass UAC via CMSTP |
test |
2022-08-30 |
| snort |
ET INFO Malware Destroyer FTP Login |
rev 1 |
2022-08-29 |
| snort |
ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Hqwar.hf Checkin |
rev 1 |
2022-08-29 |
| snort |
ET TROJAN NetSupport RAT with System Information |
rev 1 |
2022-08-29 |
| snort |
ET INFO Malware Destroyer Checkin |
rev 1 |
2022-08-29 |
| snort |
ET TROJAN Win32/Meimaii Checkin |
rev 1 |
2022-08-29 |
| snort |
ET TROJAN TA457 Backdoor CnC Activity |
rev 1 |
2022-08-29 |
| snort |
ET TROJAN TA457 Backdoor CnC Response |
rev 2 |
2022-08-29 |
| snort |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Ermak.a Checkin |
rev 2 |
2022-08-29 |
| snort |
ET CURRENT_EVENTS Successful Telstra Credential Phish 2022-08-29 |
rev 1 |
2022-08-29 |
| suricata |
ET INFO Malware Destroyer Checkin |
rev 1 |
2022-08-29 |
| suricata |
ET MALWARE TA457 Backdoor CnC Response |
rev 2 |
2022-08-29 |
| suricata |
ET MALWARE TA457 Backdoor CnC Activity |
rev 1 |
2022-08-29 |
| suricata |
ET HUNTING NOP Sled in HTTP URI Inbound - Possible Exploit Activity |
rev 4 |
2022-08-29 |