| suricata |
ET WEB_SERVER /etc/passwd Detected in URI |
rev 1 |
2023-11-29 |
| suricata |
ET INFO Remote Spring Application XML Configuration Containing ProcessBuilder Downloaded |
rev 2 |
2023-11-29 |
| suricata |
ET MALWARE Win32/LeftHook Stealer Payload Inbound |
rev 2 |
2023-11-29 |
| sigma |
LSASS Access From Potentially White-Listed Processes |
test |
2023-11-29 |
| sigma |
Credential Dumping Activity By Python Based Tool |
stable |
2023-11-29 |
| sigma |
Remote LSASS Process Access Through Windows Remote Management |
stable |
2023-11-29 |
| sigma |
Lsass Memory Dump via Comsvcs DLL |
test |
2023-11-29 |
| sigma |
LSASS Memory Access by Tool With Dump Keyword In Name |
test |
2023-11-29 |
| sigma |
Mint Sandstorm - Log4J Wstomcat Process Execution |
test |
2023-11-29 |
| snort |
ET WEB_CLIENT WebDAV GET Request for .url Flowbit Set |
rev 1 |
2023-11-28 |
| snort |
ET WEB_CLIENT WebDAV PUT Request for .url Flowbit Set |
rev 1 |
2023-11-28 |
| suricata |
ET WEB_CLIENT PROPFIND Method Xbit Set |
rev 1 |
2023-11-28 |
| sigma |
HackTool - LittleCorporal Generated Maldoc Injection |
test |
2023-11-28 |
| sigma |
HackTool - CobaltStrike BOF Injection Pattern |
test |
2023-11-28 |
| sigma |
HackTool - HandleKatz Duplicating LSASS Handle |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy |
test |
2023-11-28 |
| sigma |
Chromium Browser Instance Executed With Custom Extension |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver |
test |
2023-11-28 |
| sigma |
New Netsh Helper DLL Registered From A Suspicious Location |
test |
2023-11-28 |
| sigma |
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver |
test |
2023-11-28 |
| sigma |
Load Of RstrtMgr.DLL By A Suspicious Process |
test |
2023-11-28 |
| sigma |
Suspicious Chromium Browser Instance Executed With Custom Extension |
test |
2023-11-28 |
| sigma |
Potential Process Hollowing Activity |
test |
2023-11-28 |
| sigma |
Potential Credential Dumping Attempt Via PowerShell |
test |
2023-11-28 |
| sigma |
Potential Persistence Via Netsh Helper DLL |
test |
2023-11-28 |
| sigma |
Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths |
test |
2023-11-28 |
| snort |
ET TROJAN Win32/CHAOS RAT/AlfaC2 Checkin |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN SysJoker User-Agent Observed |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN SysJoker User-Agent Observed |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN CHAOS RAT/AlfaC2 CnC Server Status Check |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN TA406 Win32/Updog Backdoor Data Exfiltration Attempt |
rev 1 |
2023-11-27 |
| snort |
ET TROJAN Socks5Systemz CnC Checkin M2 |
rev 1 |
2023-11-27 |
| suricata |
ET MALWARE TA406 Win32/Updog Backdoor Data Exfiltration Attempt |
rev 1 |
2023-11-27 |
| suricata |
ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check |
rev 1 |
2023-11-27 |
| sigma |
Exploitation Attempt Of CVE-2023-46214 Using Public POC Code |
test |
2023-11-27 |
| sigma |
Potential CVE-2023-46214 Exploitation Attempt |
test |
2023-11-27 |
| sigma |
HackTool - Generic Process Access |
test |
2023-11-27 |
| sigma |
Windows Defender Malware Detection History Deletion |
test |
2023-11-24 |
| sigma |
Windows Defender Configuration Changes |
stable |
2023-11-24 |