| suricata |
ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt |
rev 1 |
2023-12-01 |
| sigma |
Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace |
test |
2023-12-01 |
| sigma |
Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace |
test |
2023-12-01 |
| sigma |
Potential Linux Process Code Injection Via DD Utility |
test |
2023-12-01 |
| sigma |
Import New Module Via PowerShell CommandLine |
test |
2023-12-01 |
| snort |
ET TROJAN SugarGh0st RAT CnC Checkin |
rev 1 |
2023-11-30 |
| snort |
ET WEB_SERVER .bash_history Detected in URI |
rev 1 |
2023-11-30 |
| snort |
ET INFO Successful PROPFIND Response for Application Media Type |
rev 1 |
2023-11-30 |
| snort |
ET TROJAN Suspected ToddyCat APT Curlu Related Activity M1 |
rev 1 |
2023-11-30 |
| snort |
ET WEB_SERVER vonloesch JSP File Browser |
rev 1 |
2023-11-30 |
| snort |
ET TROJAN Suspected ToddyCat APT Curlu Related Activity M2 |
rev 1 |
2023-11-30 |
| snort |
ET WEB_SERVER Simple JSP WebShell Landing Page |
rev 1 |
2023-11-30 |
| suricata |
ET WEB_SERVER vonloesch JSP File Browser |
rev 1 |
2023-11-30 |
| suricata |
ET MALWARE SugarGh0st RAT CnC Checkin |
rev 1 |
2023-11-30 |
| suricata |
ET WEB_SERVER Simple JSP WebShell Landing Page |
rev 1 |
2023-11-30 |
| suricata |
ET HUNTING Successful PROPFIND Response for Application Media Type |
rev 1 |
2023-11-30 |
| suricata |
ET WEB_SERVER .bash_history Detected in URI |
rev 1 |
2023-11-30 |
| sigma |
PUA - RemCom Default Named Pipe |
test |
2023-11-30 |
| sigma |
New PowerShell Instance Created |
test |
2023-11-30 |
| sigma |
PUA - CSExec Default Named Pipe |
test |
2023-11-30 |
| sigma |
WMI Event Consumer Created Named Pipe |
test |
2023-11-30 |
| sigma |
Function Call From Undocumented COM Interface EditionUpgradeManager |
test |
2023-11-30 |
| sigma |
ADFS Database Named Pipe Connection By Uncommon Tool |
test |
2023-11-30 |
| sigma |
Uncommon GrantedAccess Flags On LSASS |
test |
2023-11-30 |
| sigma |
Credential Dumping Attempt Via WerFault |
test |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M3 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M2 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M1 |
rev 1 |
2023-11-29 |
| snort |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M4 |
rev 1 |
2023-11-29 |
| snort |
ET WEB_SERVER /etc/passwd Detected in URI |
rev 1 |
2023-11-29 |
| snort |
ET WEB_SERVER /etc/hosts Detected in URI |
rev 1 |
2023-11-29 |
| snort |
ET TROJAN Win32/LeftHook Stealer Payload Inbound |
rev 2 |
2023-11-29 |
| snort |
ET TROJAN [ANY.RUN] Socks5Systemz TCP Backconnect Client Traffic |
rev 1 |
2023-11-29 |
| snort |
ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded |
rev 2 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M1 |
rev 1 |
2023-11-29 |
| suricata |
ET MALWARE Win32/LeftHook Stealer Payload Inbound |
rev 2 |
2023-11-29 |
| suricata |
ET ATTACK_RESPONSE Possible /etc/shadow via HTTP M2 |
rev 1 |
2023-11-29 |
| suricata |
ET MALWARE [ANY.RUN] Socks5Systemz TCP Backconnect Client Traffic |
rev 1 |
2023-11-29 |
| suricata |
ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded |
rev 2 |
2023-11-29 |
| suricata |
ET WEB_SERVER /etc/passwd Detected in URI |
rev 1 |
2023-11-29 |