| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Download Locations Response |
rev 1 |
2023-11-16 |
| suricata |
ET HUNTING Redirect to Discord Attachment Download |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Checkin |
rev 1 |
2023-11-16 |
| suricata |
ET HUNTING 302 Redirect to run .mocky .io |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Pop-Up Details Response |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Pop-Up Details Request |
rev 1 |
2023-11-16 |
| suricata |
ET MALWARE QuickBooks Pop-Up Scam - Checkin Response |
rev 1 |
2023-11-16 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - System |
test |
2023-11-15 |
| sigma |
Windows Event Auditing Disabled |
test |
2023-11-15 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - Security |
test |
2023-11-15 |
| sigma |
Important Windows Eventlog Cleared |
test |
2023-11-15 |
| sigma |
Eventlog Cleared |
test |
2023-11-15 |
| snort |
ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2023-11-14 |
| suricata |
ET INFO Ipconfig Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2023-11-14 |
| sigma |
Security Tools Keyword Lookup Via Findstr.EXE |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver) |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy) |
test |
2023-11-14 |
| sigma |
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) |
test |
2023-11-14 |
| sigma |
Uncommon Userinit Child Process |
test |
2023-11-14 |
| snort |
ET TROJAN Observed TA402 Domain in TLS SNI |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Win32/TA402 CnC Response M2 |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Win32/TA402 CnC Response M1 |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Win32/TA402 CnC User-Agent |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| snort |
ET TROJAN Win32/TA402 Checkin M2 |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Observed TA402 Domain in TLS SNI |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE TA402 CnC Domain in DNS Lookup |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Win32/TA402 CnC Response M1 |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Observed TA402 Domain in TLS SNI |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Win32/TA402 CnC User-Agent |
rev 1 |
2023-11-13 |
| suricata |
ET MALWARE Win32/TA402 CnC Response M2 |
rev 1 |
2023-11-13 |
| sigma |
Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp |
test |
2023-11-13 |
| sigma |
Non-DLL Extension File Renamed With DLL Extension |
test |
2023-11-11 |
| sigma |
Findstr GPP Passwords |
test |
2023-11-11 |
| sigma |
Suspicious Appended Extension |
test |
2023-11-11 |
| sigma |
Permission Misconfiguration Reconnaissance Via Findstr.EXE |
test |
2023-11-11 |