| sentinel |
Cisco Umbrella - Connection to Unpopular Website Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Crypto Miner User-Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Empty User Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Hack Tool User-Agent Detected |
Scheduled |
— |
| sentinel |
Palo Alto Threat signatures from Unusual IP addresses |
— |
— |
| sentinel |
Time series anomaly detection for total volume of traffic |
Scheduled |
— |
| sentinel |
Wazuh - Large Number of Web errors from an IP |
Scheduled |
— |
| sentinel |
TEARDROP memory-only dropper - Migrated to new location |
— |
— |
| sentinel |
PE file dropped in Color Profile Folder |
Scheduled |
— |
| sentinel |
SUNBURST and SUPERNOVA backdoor hashes |
— |
— |
| sentinel |
SUNBURST network beacons |
— |
— |
| sentinel |
Probable AdFind Recon Tool Usage |
— |
— |
| sentinel |
SUNBURST suspicious SolarWinds child processes |
Scheduled |
— |
| sentinel |
Potential DGA detected |
— |
— |
| sentinel |
Rare client observed with high reverse DNS lookup count |
— |
— |
| sentinel |
DNS events related to mining pools |
— |
— |
| sentinel |
DNS events related to ToR proxies |
— |
— |
| sentinel |
NRT DNS events related to mining pools |
— |
— |
| sentinel |
TI map IP entity to Duo Security |
— |
— |
| sentinel |
Trust Monitor Event |
Scheduled |
— |
| sentinel |
GitHub Activites from a New Country |
— |
— |
| sentinel |
GitHub Two Factor Auth Disable |
— |
— |
| sentinel |
NRT GitHub Two Factor Auth Disable |
NRT |
— |
| sentinel |
GitHub Security Vulnerability in Repository |
Scheduled |
— |
| yara |
Network_WinXPx86 |
— |
— |
| yara |
SmartCopy2 |
— |
— |
| yara |
remsec_executable_blob_64 |
— |
— |
| yara |
md5_8e5f7f6523891a5dcefcbb1a79e5bbe9 |
— |
— |
| yara |
eval_base64_decode_a |
— |
— |
| yara |
NetC |
— |
— |
| yara |
RabbitStew64 |
— |
— |
| yara |
RkNTLoad |
— |
— |
| yara |
hkshell_hkshell |
— |
— |
| yara |
iMHaPFtp |
— |
— |
| yara |
Unpack_TBack |
— |
— |
| yara |
DarkSpy105 |
— |
— |
| yara |
EditServer_Webshell |
— |
— |
| yara |
FSO_s_reader |
— |
— |
| yara |
ASP_CmdAsp |
— |
— |
| yara |
KA_uShell |
— |
— |