| sigma |
Windows Defender Configuration Changes |
stable |
2023-11-24 |
| sigma |
Execution of Suspicious File Type Extension |
test |
2023-11-23 |
| snort |
ET TROJAN TA422 Related Activity M5 |
rev 1 |
2023-11-22 |
| suricata |
ET MALWARE TA422 Related Activity M5 |
rev 1 |
2023-11-22 |
| sigma |
Windows Defender Grace Period Expired |
stable |
2023-11-22 |
| sigma |
PowerView PowerShell Cmdlets - ScriptBlock |
test |
2023-11-22 |
| sigma |
Windows Defender Malware And PUA Scanning Disabled |
stable |
2023-11-22 |
| sigma |
Windows Defender Real-time Protection Disabled |
stable |
2023-11-22 |
| sigma |
Windows Defender Virus Scanning Feature Disabled |
stable |
2023-11-22 |
| snort |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Request for lk3_settings.bin Backup File |
rev 1 |
2023-11-21 |
| snort |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - System Restart Request |
rev 1 |
2023-11-21 |
| snort |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - EEPROM Reset |
rev 1 |
2023-11-21 |
| suricata |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - System Restart Request |
rev 1 |
2023-11-21 |
| suricata |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Denial of Service Attempt - EEPROM Reset |
rev 1 |
2023-11-21 |
| suricata |
ET WEB_SPECIFIC_APPS Tinycontrol LAN Controller v3 Request for lk3_settings.bin Backup File |
rev 1 |
2023-11-21 |
| sigma |
File or Folder Permissions Modifications |
test |
2023-11-21 |
| sigma |
Uncommon Extension In Keyboard Layout IME File Registry Value |
test |
2023-11-21 |
| sigma |
Suspicious Path In Keyboard Layout IME File Registry Value |
test |
2023-11-21 |
| snort |
ET SCAN LeakIX Inbound User-Agent |
rev 1 |
2023-11-20 |
| snort |
ET INFO F5 BIG-IP - Failed Auth Due To Expired Password |
rev 1 |
2023-11-20 |
| suricata |
ET SCAN LeakIX Inbound User-Agent |
rev 1 |
2023-11-20 |
| suricata |
ET INFO F5 BIG-IP - Failed Auth Due To Expired Password |
rev 1 |
2023-11-20 |
| sigma |
DNS Query To Devtunnels Domain |
test |
2023-11-20 |
| sigma |
Network Connection Initiated To Visual Studio Code Tunnels Domain |
test |
2023-11-20 |
| sigma |
Network Connection Initiated To DevTunnels Domain |
test |
2023-11-20 |
| sigma |
DNS Query To Visual Studio Code Tunnels Domain |
test |
2023-11-20 |
| sigma |
Important Windows Event Auditing Disabled |
test |
2023-11-17 |
| snort |
ET INFO DLL File Download Request via Discord |
rev 1 |
2023-11-16 |
| snort |
ET INFO RAR File Download Request via Discord |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Pop-Up Details Response |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Pop-Up Details Request |
rev 1 |
2023-11-16 |
| snort |
ET INFO 302 Redirect to run .mocky .io |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Checkin |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Checkin Response |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Download Locations Response |
rev 1 |
2023-11-16 |
| snort |
ET TROJAN QuickBooks Pop-Up Scam - Request for QB Download Locations |
rev 1 |
2023-11-16 |
| snort |
ET INFO ZIP File Download Request via Discord |
rev 1 |
2023-11-16 |
| snort |
ET INFO EXE File Download Request via Discord |
rev 3 |
2023-11-16 |
| snort |
ET INFO Redirect to Discord Attachment Download |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Pop-Up Details Request |
rev 1 |
2023-11-16 |