| suricata |
ET INFO Nessus Server SSL certificate detected |
rev 3 |
2022-02-26 |
| snort |
ET EXPLOIT CreateService via SMB to Reset-ComputerMachinePassword - Observed Post Zerologon Activity |
rev 2 |
2022-02-25 |
| suricata |
ET EXPLOIT CreateService via SMB to Reset-ComputerMachinePassword - Observed Post Zerologon Activity |
rev 2 |
2022-02-25 |
| sigma |
Suspicious MSExchangeMailboxReplication ASPX Write |
test |
2022-02-25 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-02-25 |
rev 2 |
2022-02-24 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2022-02-25 |
rev 2 |
2022-02-24 |
| sigma |
DPAPI Domain Backup Key Extraction |
test |
2022-02-24 |
| sigma |
T1047 Wmiprvse Wbemcomn DLL Hijack |
test |
2022-02-24 |
| sigma |
Security Eventlog Cleared |
test |
2022-02-24 |
| snort |
ET TROJAN ReverseRat 2.0 CnC Checkin M2 |
rev 2 |
2022-02-23 |
| sigma |
Suspicious Computer Machine Password by PowerShell |
test |
2022-02-21 |
| snort |
ET MALWARE Win32/2144FlashPlayer.E Checkin |
rev 2 |
2022-02-16 |
| snort |
ET INFO Namecheap URL Forward |
rev 2 |
2022-02-16 |
| suricata |
ET ADWARE_PUP Win32/2144FlashPlayer.E Checkin |
rev 1 |
2022-02-16 |
| snort |
ET TROJAN Suspected RULER.Hacktool HTML Payload |
rev 1 |
2022-02-14 |
| suricata |
ET MALWARE Suspected RULER.Hacktool HTML Payload |
rev 1 |
2022-02-14 |
| sigma |
GoToAssist Temporary Installation Artefact |
test |
2022-02-13 |
| sigma |
ScreenConnect Temporary Installation Artefact |
test |
2022-02-13 |
| sigma |
Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC |
test |
2022-02-12 |
| sigma |
DirectorySearcher Powershell Exploitation |
test |
2022-02-12 |
| sigma |
ISO or Image Mount Indicator in Recent Files |
test |
2022-02-11 |
| sigma |
BPFtrace Unsafe Option Usage |
test |
2022-02-11 |
| sigma |
WMI Persistence |
test |
2022-02-10 |
| snort |
ET TROJAN Gamaredon CnC Domain in DNS Lookup |
rev 1 |
2022-02-09 |
| snort |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| snort |
ET INFO Keweon Center DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| snort |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 2 |
2022-02-09 |
| snort |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| snort |
ET INFO Keweon Center DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| snort |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 2 |
2022-02-09 |
| snort |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| suricata |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| suricata |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| suricata |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| suricata |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| suricata |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 1 |
2022-02-09 |
| snort |
ET INFO UncensoredDNS DNS Over HTTPS Certificate Inbound |
rev 2 |
2022-02-08 |
| snort |
ET INFO Applied Privacy DNS over HTTPS Certificate Inbound |
rev 2 |
2022-02-08 |
| sigma |
New Federated Domain Added - Exchange |
test |
2022-02-08 |
| snort |
ET CURRENT_EVENTS Standard Bank Login Phish 2022-02-04 |
rev 1 |
2022-02-07 |