| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriverDirectory |
rev 3 |
2021-07-14 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriver |
rev 3 |
2021-07-14 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncAddPrinterDriver |
rev 4 |
2021-07-14 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncCorePrinterDriverInstalled |
rev 3 |
2021-07-14 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriverPackage |
rev 3 |
2021-07-14 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriverPackagePath |
rev 3 |
2021-07-14 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriverEx |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriver |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetCorePrinterDrivers |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriverPackage |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncCorePrinterDriverInstalled |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncEnumPrinterDrivers |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriverEx |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriverPackagePath |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncDeletePrinterDriver |
rev 3 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncAddPrinterDriver |
rev 4 |
2021-07-14 |
| suricata |
ET INFO [MS-PAR] Windows Printer Spooler Activity - RpcAsyncGetPrinterDriverDirectory |
rev 3 |
2021-07-14 |
| snort |
ET MOBILE_MALWARE PJobRat System Exfil to CnC |
rev 1 |
2021-07-13 |
| snort |
ET MOBILE_MALWARE PJobRat CnC Checkin |
rev 1 |
2021-07-13 |
| suricata |
ET MOBILE_MALWARE PJobRat CnC Checkin |
rev 1 |
2021-07-13 |
| snort |
ET TROJAN WildPressure/Milum CnC Activity |
rev 1 |
2021-07-12 |
| snort |
ET INFO jpg download from fileupload .site |
rev 1 |
2021-07-09 |
| snort |
ET TROJAN Win32/DCRat CnC Exfil |
rev 3 |
2021-07-09 |
| snort |
ET POLICY [MS-RPRN] Windows Printer Spooler Activity - AddPrinterDriverEx with Suspicious Filepath |
rev 3 |
2021-07-08 |
| suricata |
ET INFO [MS-RPRN] Windows Printer Spooler Activity - AddPrinterDriverEx with Suspicious Filepath |
rev 3 |
2021-07-08 |
| snort |
ET TROJAN IRC Bot Download http Command |
rev 5 |
2021-07-07 |
| snort |
ET USER_AGENTS WaterDropX PRISM UA Observed |
rev 1 |
2021-07-07 |
| snort |
ET TROJAN WaterDropX PRISM CnC Response |
rev 2 |
2021-07-07 |
| snort |
ET TROJAN IRC Channel join on non-standard port |
rev 12 |
2021-07-07 |
| snort |
ET TROJAN WaterDropX PRISM CnC Checkin |
rev 2 |
2021-07-07 |
| snort |
GPL CHAT IRC Channel join |
rev 11 |
2021-07-07 |
| snort |
ET TROJAN Possible Siloscape IRC CnC JOIN Command Observed |
rev 2 |
2021-07-07 |
| suricata |
ET MALWARE Possible Siloscape IRC CnC JOIN Command Observed |
rev 1 |
2021-07-07 |
| suricata |
ET USER_AGENTS WaterDropX PRISM UA Observed |
rev 1 |
2021-07-07 |
| snort |
ET TROJAN Possible Kaseya VSA Exploit URI Structure Inbound |
rev 1 |
2021-07-06 |
| snort |
ET TROJAN Possible Kaseya VSA Exploit Activity Inbound M2 |
rev 1 |
2021-07-06 |
| snort |
ET TROJAN Diavol Communicating with CnC - Ignore Request |
rev 1 |
2021-07-05 |
| snort |
ET TROJAN Diavol Communicating with CnC - Landing Request |
rev 1 |
2021-07-05 |
| snort |
ET TROJAN Diavol Communicating with CnC - Priority Request |
rev 1 |
2021-07-05 |
| snort |
ET TROJAN Diavol Communicating with CnC - Ext Request |
rev 1 |
2021-07-05 |