| suricata |
ET MALWARE Malicious Loader Related Activity Response |
rev 1 |
2023-12-20 |
| suricata |
ET INFO Google DNS Over HTTPS Certificate Inbound |
rev 5 |
2023-12-20 |
| suricata |
ET MALWARE JaskaGO CnC Host Profile Exfil |
rev 1 |
2023-12-20 |
| sigma |
Cloudflared Tunnels Related DNS Requests |
test |
2023-12-20 |
| sigma |
Cloudflared Quick Tunnel Execution |
test |
2023-12-20 |
| sigma |
System Information Discovery Using sw_vers |
test |
2023-12-20 |
| sigma |
Potential Base64 Decoded From Images |
test |
2023-12-20 |
| sigma |
Cloudflared Portable Execution |
test |
2023-12-20 |
| sigma |
Renamed Cloudflared.EXE Execution |
test |
2023-12-20 |
| sigma |
Cloudflared Tunnel Execution |
test |
2023-12-20 |
| snort |
ET CURRENT_EVENTS SWAT USA Drop Login Panel |
rev 1 |
2023-12-19 |
| snort |
ET POLICY HTTP Outbound Request contains pw |
rev 4 |
2023-12-19 |
| snort |
ET CURRENT_EVENTS ghayt_Zone Phishing Kit |
rev 2 |
2023-12-19 |
| snort |
ET INFO Possible Phish - Mirrored Website Comment Observed |
rev 6 |
2023-12-19 |
| suricata |
ET PHISHING SWAT USA Drop Login Panel |
rev 1 |
2023-12-19 |
| suricata |
ET PHISHING Possible Phish - Mirrored Website Comment Observed |
rev 7 |
2023-12-19 |
| suricata |
ET PHISHING ghayt_Zone Phishing Kit |
rev 2 |
2023-12-19 |
| sigma |
Suspicious New Instance Of An Office COM Object |
test |
2023-12-19 |
| sigma |
Uncommon System Information Discovery Via Wmic.EXE |
test |
2023-12-19 |
| sigma |
Compressed File Extraction Via Tar.EXE |
test |
2023-12-19 |
| sigma |
Compressed File Creation Via Tar.EXE |
test |
2023-12-19 |
| snort |
ET TROJAN Win32/Blacklegion Ransomware CnC Checkin |
rev 1 |
2023-12-18 |
| snort |
ET TROJAN Win32/Blacklegion Ransomware CnC Response |
rev 1 |
2023-12-18 |
| suricata |
ET MALWARE Win32/Blacklegion Ransomware CnC Response |
rev 1 |
2023-12-18 |
| sigma |
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor |
test |
2023-12-18 |
| sigma |
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler |
test |
2023-12-18 |
| sigma |
DLL Names Used By SVR For GraphicalProton Backdoor |
test |
2023-12-18 |
| sigma |
Potentially Suspicious Command Targeting Teams Sensitive Files |
test |
2023-12-18 |
| sigma |
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script |
test |
2023-12-18 |
| sigma |
Zip A Folder With PowerShell For Staging In Temp - PowerShell |
test |
2023-12-18 |
| sigma |
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module |
test |
2023-12-18 |
| snort |
ET TROJAN Latrodectus Alive Response M7 |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Latrodectus Alive Response M2 |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Latrodectus Alive Response M6 |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Win32/Spyder Successful CnC Checkin |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Latrodectus Alive Response M3 |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Latrodectus Alive Response M4 |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Latrodectus Alive Response M8 |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Latrodectus Alive Response M5 |
rev 1 |
2023-12-15 |