| snort |
ET TROJAN TA455 CnC Domain in DNS Lookup |
rev 2 |
2021-08-26 |
| snort |
ET TROJAN W32/Witch.3FA0!tr CnC Activity |
rev 2 |
2021-08-26 |
| snort |
ET TROJAN TA455 CnC Domain in DNS Lookup |
rev 2 |
2021-08-26 |
| snort |
ET CURRENT_EVENTS Javascript Displays malicious download page |
rev 2 |
2021-08-26 |
| suricata |
ET MALWARE Javascript Displays malicious download page |
rev 2 |
2021-08-26 |
| suricata |
ET MALWARE Observed Default CobaltStrike SSL Certificate |
rev 2 |
2021-08-26 |
| snort |
ET TROJAN SparklingGoblin/Winnti Group SideWalk Domain in DNS Lookup |
rev 2 |
2021-08-25 |
| snort |
ET TROJAN Win32/Sinresby.B Downloader CnC Activity M2 |
rev 2 |
2021-08-25 |
| snort |
ET TROJAN Win32/Sinresby.B Downloader CnC Activity M1 |
rev 2 |
2021-08-25 |
| snort |
ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M1 |
rev 2 |
2021-08-25 |
| snort |
ET TROJAN SparklingGoblin/Winnti Group SideWalk Domain in DNS Lookup |
rev 2 |
2021-08-25 |
| snort |
ET TROJAN GCleaner Downloader Activity M4 |
rev 2 |
2021-08-25 |
| snort |
ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M2 |
rev 2 |
2021-08-25 |
| snort |
ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M3 |
rev 2 |
2021-08-25 |
| snort |
ET TROJAN Konni RAT Querying CnC for Commands |
rev 1 |
2021-08-25 |
| suricata |
ET MALWARE Konni RAT Exfiltrating Data |
rev 1 |
2021-08-25 |
| suricata |
ET MALWARE Win32/Sinresby.B Downloader CnC Activity M2 |
rev 2 |
2021-08-25 |
| suricata |
ET MALWARE Konni RAT Querying CnC for Commands |
rev 1 |
2021-08-25 |
| snort |
ET TROJAN Win32/a310Logger Data Exfil via SMTP |
rev 2 |
2021-08-24 |
| snort |
ET TROJAN Win32/a310Logger Clipboard Exfil via SMTP |
rev 2 |
2021-08-24 |
| suricata |
ET MALWARE Win32/a310Logger Clipboard Exfil via SMTP |
rev 1 |
2021-08-24 |
| suricata |
ET MALWARE Win32/a310Logger Data Exfil via SMTP |
rev 1 |
2021-08-24 |
| snort |
ET TROJAN Observed Karen Ransomware Powershell Loader |
rev 1 |
2021-08-23 |
| snort |
ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M3 |
rev 1 |
2021-08-23 |
| snort |
ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M1 |
rev 1 |
2021-08-23 |
| snort |
ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M4 |
rev 1 |
2021-08-23 |
| snort |
ET TROJAN Win32/Kryptik.HMCH Dropper User-Agent M2 |
rev 1 |
2021-08-23 |
| snort |
ET TROJAN US-CERT TA14-353A Proxy Tool 3 |
rev 2 |
2021-08-20 |
| suricata |
ET MALWARE US-CERT TA14-353A Proxy Tool 3 |
rev 3 |
2021-08-20 |
| sigma |
AWS EC2 Disable EBS Encryption |
stable |
2021-08-20 |
| snort |
ET INFO Base64 Encoded whoami in HTTP Server Response |
rev 1 |
2021-08-19 |
| snort |
ET TROJAN MSIL/Agent.DNL CnC Activity M1 |
rev 1 |
2021-08-19 |
| snort |
ET TROJAN Win32/Malgent!MSR Dropper Requesting Payload |
rev 1 |
2021-08-19 |
| snort |
ET TROJAN Win32/Malgent!MSR User-Agent |
rev 1 |
2021-08-19 |
| suricata |
ET HUNTING Base64 Encoded whoami in HTTP Server Response |
rev 1 |
2021-08-19 |
| sigma |
AWS Snapshot Backup Exfiltration |
test |
2021-08-19 |
| snort |
ET TROJAN Win32/BLUELIGHT OAuth Login Attempt M2 |
rev 1 |
2021-08-18 |
| snort |
ET TROJAN Win32/BLUELIGHT OAuth Login Attempt |
rev 1 |
2021-08-18 |
| snort |
ET TROJAN DarkWay Client Checkin |
rev 2 |
2021-08-17 |
| suricata |
ET MALWARE DarkWay Client Checkin |
rev 1 |
2021-08-17 |