| sigma |
HH.EXE Execution |
test |
2023-12-11 |
| sigma |
Registry Persistence via Explorer Run Key |
test |
2023-12-11 |
| sigma |
PUA - Nmap/Zenmap Execution |
test |
2023-12-11 |
| sigma |
Suspicious Executable File Creation |
test |
2023-12-11 |
| sigma |
Suspicious File Creation Activity From Fake Recycle.Bin Folder |
test |
2023-12-11 |
| sigma |
PUA - Radmin Viewer Utility Execution |
test |
2023-12-11 |
| sigma |
RDP Connection Allowed Via Netsh.EXE |
test |
2023-12-11 |
| sigma |
Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE |
test |
2023-12-11 |
| sigma |
Locked Workstation |
stable |
2023-12-11 |
| sigma |
Uncommon Child Process Of Conhost.EXE |
test |
2023-12-11 |
| snort |
ET TROJAN ReverseLoader Reverse Base64 Encoded Executable In Image M2 |
rev 1 |
2023-12-08 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x |
rev 1 |
2023-12-08 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x |
rev 1 |
2023-12-08 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M2 Version 4.x-7.x |
rev 1 |
2023-12-08 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22522 Vulnerable Server Detected M1 Version 4.x-7.x |
rev 1 |
2023-12-08 |
| suricata |
ET MALWARE ReverseLoader Reverse Base64 Encoded Executable In Image M2 |
rev 1 |
2023-12-08 |
| snort |
ET TROJAN SnappyTCP Reverse Shell Client Checkin M2 |
rev 1 |
2023-12-06 |
| snort |
ET TROJAN SnappyTCP Reverse Shell Client Checkin M1 |
rev 1 |
2023-12-06 |
| snort |
ET TROJAN SnappyTCP Reverse Shell Header Value Observed |
rev 1 |
2023-12-06 |
| sigma |
Potential Shim Database Persistence via Sdbinst.EXE |
test |
2023-12-06 |
| sigma |
Suspicious Shim Database Patching Activity |
test |
2023-12-06 |
| sigma |
New Custom Shim Database Created |
test |
2023-12-06 |
| snort |
ET CURRENT_EVENTS USPS Phish Landing Page 2023-12-05 |
rev 1 |
2023-12-05 |
| suricata |
ET PHISHING USPS Phish Landing Page 2023-12-05 |
rev 1 |
2023-12-05 |
| sigma |
Unusual Parent Process For Cmd.EXE |
test |
2023-12-05 |
| sigma |
PowerShell Execution With Potential Decryption Capabilities |
test |
2023-12-05 |
| snort |
ET CURRENT_EVENTS PerSwaysion Phishkit Javascript Checks if New Visitor |
rev 3 |
2023-12-04 |
| suricata |
ET PHISHING PerSwaysion Phishkit Javascript Checks if New Visitor |
rev 3 |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution - ScriptBlock |
test |
2023-12-04 |
| sigma |
Suspicious Service Installation |
test |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution |
test |
2023-12-04 |
| sigma |
Add Potential Suspicious New Download Source To Winget |
test |
2023-12-04 |
| sigma |
Whoami.EXE Execution From Privileged Process |
test |
2023-12-04 |
| sigma |
Whoami.EXE Execution With Output Option |
test |
2023-12-04 |
| sigma |
Vulnerable Driver Load By Name |
test |
2023-12-02 |
| sigma |
Vulnerable Driver Load |
test |
2023-12-02 |
| sigma |
Malicious Driver Load By Name |
test |
2023-12-02 |
| sigma |
Malicious Driver Load |
test |
2023-12-02 |
| snort |
ET TROJAN Win32/Unknown Grabber Base64 Data Exfiltration Attempt |
rev 1 |
2023-12-01 |
| suricata |
ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt |
rev 1 |
2023-12-01 |