| suricata |
ET MALWARE APT CozyCar SSL Cert 5 |
rev 4 |
2024-03-06 |
| suricata |
ET INFO HTTP Request to a 3322.org.cn Domain |
rev 5 |
2024-03-06 |
| suricata |
ET EXPLOIT TP-LINK TL-WR841N Router DNS Change GET Request |
rev 5 |
2024-03-06 |
| suricata |
ET INFO TLS possible TOR SSL traffic |
rev 5 |
2024-03-06 |
| suricata |
ET MALWARE Linux/dtool IRC Command Complete 2 |
rev 5 |
2024-03-06 |
| suricata |
ET INFO Nessus Vulnerability Scanner Plugins Update |
rev 7 |
2024-03-06 |
| suricata |
ET WEB_SPECIFIC_APPS VidShare Pro listing_video.php catid Parameter SQL Injection |
rev 7 |
2024-03-06 |
| suricata |
ET SCAN Springenwerk XSS Scanner User-Agent Detected |
rev 7 |
2024-03-06 |
| suricata |
ET WEB_SPECIFIC_APPS Check New findoffice.php search parameter Remote SQL Injection |
rev 8 |
2024-03-06 |
| sigma |
Shell Context Menu Command Tampering |
test |
2024-03-06 |
| sigma |
Potential SentinelOne Shell Context Menu Scan Command Tampering |
test |
2024-03-06 |
| sigma |
Potentially Suspicious Ping/Copy Command Combination |
test |
2024-03-06 |
| sigma |
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE |
test |
2024-03-06 |
| sigma |
PsExec/PAExec Escalation to LOCAL SYSTEM |
test |
2024-03-05 |
| sigma |
Esentutl Steals Browser Information |
test |
2024-03-05 |
| sigma |
Forfiles Command Execution |
test |
2024-03-05 |
| sigma |
Remote File Download Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Insensitive Subfolder Search Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
New Root Certificate Installed Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
File Deletion Via Del |
test |
2024-03-05 |
| sigma |
Qakbot Regsvr32 Calc Pattern |
test |
2024-03-05 |
| sigma |
Rebuild Performance Counter Values Via Lodctr.EXE |
test |
2024-03-05 |
| sigma |
Diskshadow Script Mode - Execution From Potential Suspicious Location |
test |
2024-03-05 |
| sigma |
Diskshadow Script Mode - Uncommon Script Extension Execution |
test |
2024-03-05 |
| sigma |
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE |
test |
2024-03-05 |
| sigma |
Console CodePage Lookup Via CHCP |
test |
2024-03-05 |
| sigma |
Certificate Exported Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
File In Suspicious Location Encoded To Base64 Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
Suspicious File Encoded To Base64 Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
File Encoded To Base64 Via Certutil.EXE |
test |
2024-03-05 |
| sigma |
DLL Loaded via CertOC.EXE |
test |
2024-03-05 |
| sigma |
New Generic Credentials Added Via Cmdkey.EXE |
test |
2024-03-05 |
| sigma |
Enumerate All Information With Whoami.EXE |
test |
2024-03-05 |
| sigma |
Port Forwarding Activity Via SSH.EXE |
test |
2024-03-05 |
| sigma |
Suspicious Service Installation Script |
test |
2024-03-05 |
| sigma |
Potential Privilege Escalation To LOCAL SYSTEM |
test |
2024-03-05 |
| sigma |
Suspicious DLL Loaded via CertOC.EXE |
test |
2024-03-05 |
| sigma |
Curl Download And Execute Combination |
test |
2024-03-05 |
| sigma |
Response File Execution Via Odbcconf.EXE |
test |
2024-03-05 |
| sigma |
Suspicious Ping/Del Command Combination |
test |
2024-03-05 |