| snort |
ET TROJAN Suspected Kimsuky APT RevClient Related Activity |
rev 1 |
2023-12-13 |
| snort |
ET INFO WebDAV Retrieving .zip containing .exe |
rev 1 |
2023-12-13 |
| snort |
ET TROJAN Win32/LeftHook Stealer Browser Extension Config Inbound |
rev 2 |
2023-12-13 |
| snort |
ET POLICY Vulnerable Java Version 16.0.x Detected |
rev 4 |
2023-12-13 |
| snort |
ET WEB_CLIENT WebDAV Retrieving an .url |
rev 2 |
2023-12-13 |
| snort |
ET POLICY Vulnerable Java Version 14.0.x Detected |
rev 4 |
2023-12-13 |
| snort |
ET POLICY Vulnerable Java Version 1.6.x Detected |
rev 53 |
2023-12-13 |
| snort |
ET TROJAN RaccoonStealer Admin Console Inbound |
rev 2 |
2023-12-13 |
| snort |
ET TROJAN Win32/StormKitty CnC Telegram Notification M1 |
rev 2 |
2023-12-13 |
| snort |
ET POLICY Vulnerable Java Version 18.0.x Detected |
rev 2 |
2023-12-13 |
| snort |
ET POLICY Vulnerable Java Version 12.0.x Detected |
rev 4 |
2023-12-13 |
| snort |
ET POLICY Vulnerable Java Version 9.x Detected |
rev 4 |
2023-12-13 |
| snort |
ET POLICY Vulnerable Java Version 1.4.x Detected |
rev 11 |
2023-12-13 |
| suricata |
ET MALWARE Win32/StormKitty CnC Telegram Notification M1 |
rev 3 |
2023-12-13 |
| suricata |
ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
rev 3 |
2023-12-13 |
| suricata |
ET MALWARE Win32/StormKitty CnC Telegram Notification M2 |
rev 3 |
2023-12-13 |
| suricata |
ET MALWARE Suspected Kimsuky APT RevClient Related Activity |
rev 1 |
2023-12-13 |
| suricata |
ET MALWARE RaccoonStealer Admin Console Inbound |
rev 2 |
2023-12-13 |
| suricata |
ET MALWARE RedLine Stealer - CheckConnect Response |
rev 3 |
2023-12-13 |
| sigma |
Dumping of Sensitive Hives Via Reg.EXE |
test |
2023-12-13 |
| sigma |
Potential Direct Syscall of NtOpenProcess |
test |
2023-12-13 |
| sigma |
Uncommon File Created In Office Startup Folder |
test |
2023-12-13 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M2 |
rev 1 |
2023-12-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2022-1471 Vulnerable Server Detected Version 6.13.x - 6.15.x M1 |
rev 1 |
2023-12-12 |
| snort |
ET INFO vibe.d Library User-Agent |
rev 1 |
2023-12-12 |
| snort |
ET INFO EXE extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| snort |
ET INFO PDF extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| snort |
ET INFO wget in DNS TXT Response |
rev 1 |
2023-12-12 |
| snort |
ET INFO curl in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING PDF extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING curl in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING EXE extension in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET HUNTING wget in DNS TXT Response |
rev 1 |
2023-12-12 |
| suricata |
ET INFO HTTP Outbound Request contains pw |
rev 5 |
2023-12-12 |
| suricata |
ET HUNTING vibe.d Library User-Agent |
rev 1 |
2023-12-12 |
| snort |
ET TROJAN Win32/Asmodeasmo Bot CnC Checkin |
rev 1 |
2023-12-11 |
| snort |
ET TROJAN Drivermax Utility Checkin Activity |
rev 1 |
2023-12-11 |
| suricata |
ET MALWARE Win32/Asmodeasmo Bot CnC Checkin |
rev 1 |
2023-12-11 |
| sigma |
Suspicious Process Execution From Fake Recycle.Bin Folder |
test |
2023-12-11 |
| sigma |
HH.EXE Execution |
test |
2023-12-11 |