| sigma |
Suspicious Windows Update Agent Empty Cmdline |
test |
2023-11-11 |
| sigma |
Proxy Execution Via Wuauclt.EXE |
test |
2023-11-11 |
| sigma |
Findstr GPP Passwords |
test |
2023-11-11 |
| sigma |
Non-DLL Extension File Renamed With DLL Extension |
test |
2023-11-11 |
| snort |
ET TROJAN Win32/Unknown RAT CnC Server Acknowledgement |
rev 1 |
2023-11-10 |
| snort |
ET TROJAN Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 |
rev 1 |
2023-11-10 |
| suricata |
ET MALWARE Win32/Unknown RAT CnC Server Acknowledgement |
rev 1 |
2023-11-10 |
| sigma |
Suspicious WmiPrvSE Child Process |
test |
2023-11-10 |
| sigma |
Remote Thread Creation Via PowerShell |
test |
2023-11-10 |
| sigma |
Remote Thread Creation Via PowerShell In Uncommon Target |
test |
2023-11-10 |
| sigma |
Portable Gpg.EXE Execution |
test |
2023-11-10 |
| snort |
ET INFO Supabase Development Platform Related Domain in DNS Lookup |
rev 1 |
2023-11-09 |
| snort |
ET TROJAN Seetrol Remote Administration Tool Download |
rev 1 |
2023-11-09 |
| snort |
ET TROJAN MACE C2 Framework Response M1 |
rev 1 |
2023-11-09 |
| suricata |
ET INFO Supabase Development Platform Related Domain in DNS Lookup |
rev 1 |
2023-11-09 |
| suricata |
ET ADWARE_PUP Seetrol Remote Administration Tool Download |
rev 1 |
2023-11-09 |
| suricata |
ET USER_AGENTS Seetrol Client Remote Administration Tool User-Agent |
rev 1 |
2023-11-09 |
| sigma |
Lace Tempest Malware Loader Execution |
test |
2023-11-09 |
| sigma |
Lace Tempest File Indicators |
test |
2023-11-09 |
| sigma |
Lace Tempest PowerShell Launcher |
test |
2023-11-09 |
| sigma |
Lace Tempest PowerShell Evidence Eraser |
test |
2023-11-09 |
| sigma |
Lace Tempest Cobalt Strike Download |
test |
2023-11-09 |
| sigma |
File Download Using ProtocolHandler.exe |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via Squirrel.EXE |
test |
2023-11-09 |
| sigma |
XBAP Execution From Uncommon Locations Via PresentationHost.EXE |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via IMEWDBLD.EXE |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via MSEDGE_PROXY.EXE |
test |
2023-11-09 |
| sigma |
Potential File Download Via MS-AppInstaller Protocol Handler |
test |
2023-11-09 |
| sigma |
File Download Via InstallUtil.EXE |
test |
2023-11-09 |
| sigma |
Uncommon Child Process Of Appvlp.EXE |
test |
2023-11-09 |
| sigma |
Potentially Suspicious Electron Application CommandLine |
test |
2023-11-09 |
| sigma |
Webshell Tool Reconnaissance Activity |
test |
2023-11-09 |
| sigma |
File Download And Execution Via IEExec.EXE |
test |
2023-11-09 |
| sigma |
File Download Via Windows Defender MpCmpRun.EXE |
test |
2023-11-09 |
| sigma |
Webshell Hacking Activity Patterns |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via PresentationHost.EXE |
test |
2023-11-09 |
| sigma |
Remote XSL Execution Via Msxsl.EXE |
test |
2023-11-09 |
| sigma |
AppX Package Installation Attempts Via AppInstaller.EXE |
test |
2023-11-09 |
| sigma |
Arbitrary File Download Via MSOHTMED.EXE |
test |
2023-11-09 |
| sigma |
Network Connection Initiated By IMEWDBLD.EXE |
test |
2023-11-09 |