| suricata |
ET INFO Malware Destroyer Checkin |
rev 1 |
2022-08-29 |
| snort |
ET TROJAN Win32/Unknown CnC Activity |
rev 1 |
2022-08-26 |
| snort |
ET CURRENT_EVENTS Successful Bank of America Credential Phish 2022-08-25 |
rev 1 |
2022-08-26 |
| suricata |
ET MALWARE Win32/Unknown CnC Activity |
rev 1 |
2022-08-26 |
| suricata |
ET PHISHING Successful Bank of America Credential Phish 2022-08-25 |
rev 1 |
2022-08-26 |
| sigma |
Suspicious SysAidServer Child |
test |
2022-08-26 |
| sigma |
Dism Remove Online Package |
test |
2022-08-26 |
| snort |
ET CURRENT_EVENTS PyPI Successful Credential Harvesting Attempt |
rev 1 |
2022-08-25 |
| snort |
ET MALWARE pdfspeedup Keep-Alive |
rev 1 |
2022-08-25 |
| snort |
ET TROJAN PyPI Malicious Library Update Payload Checkin |
rev 1 |
2022-08-25 |
| snort |
ET TROJAN Win32/Filecoder.GC CnC Credentials Exfil |
rev 1 |
2022-08-25 |
| snort |
ET TROJAN Possible OSX/SHLAYER Checkin M2 |
rev 1 |
2022-08-25 |
| snort |
ET MALWARE pdfspeedup Initial CnC Checkin |
rev 1 |
2022-08-25 |
| suricata |
ET MALWARE Win32/Filecoder.GC CnC Credentials Exfil |
rev 1 |
2022-08-25 |
| suricata |
ET PHISHING PyPI Successful Credential Harvesting Attempt |
rev 1 |
2022-08-25 |
| suricata |
ET MALWARE PyPI Malicious Library Update Payload Checkin |
rev 1 |
2022-08-25 |
| sigma |
Sliver C2 Default Service Installation |
test |
2022-08-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.anondns .net Domain |
rev 1 |
2022-08-24 |
| snort |
ET ATTACK_RESPONSE net user Command Output via HTTP POST |
rev 1 |
2022-08-24 |
| suricata |
ET ATTACK_RESPONSE net user Command Output via HTTP POST |
rev 1 |
2022-08-24 |
| sigma |
Bitsadmin to Uncommon IP Server Address |
test |
2022-08-24 |
| snort |
ET INFO SAFIB Assistant Remote Administration Tool Keepalive |
rev 1 |
2022-08-23 |
| suricata |
ET INFO SAFIB Assistant Remote Administration Tool Keepalive |
rev 1 |
2022-08-23 |
| sigma |
Azure DNS Zone Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Application Security Group Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Container Registry Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Application Gateway Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure New CloudShell Created |
test |
2022-08-23 |
| sigma |
Azure Keyvault Key Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Firewall Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Firewall Rule Collection Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Virtual Network Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Firewall Rule Configuration Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure VPN Connection Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Subscription Permission Elevation Via ActivityLogs |
test |
2022-08-23 |
| sigma |
Azure Network Firewall Policy Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Point-to-site VPN Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Service Account Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Virtual Network Device Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Secret or Config Object Access |
test |
2022-08-23 |