| sigma |
Msxsl.EXE Execution |
test |
2023-11-09 |
| sigma |
File Download Using ProtocolHandler.exe |
test |
2023-11-09 |
| sigma |
XBAP Execution From Uncommon Locations Via PresentationHost.EXE |
test |
2023-11-09 |
| sigma |
Remote XSL Execution Via Msxsl.EXE |
test |
2023-11-09 |
| sigma |
ISO Image Mounted |
test |
2023-11-09 |
| snort |
ET TROJAN Bandit Stealer Host Details Exfil |
rev 1 |
2023-11-08 |
| snort |
ET TROJAN Bandit Stealer Config Inbound |
rev 1 |
2023-11-08 |
| snort |
ET INFO HTTP GET Request for AutoItX3 |
rev 1 |
2023-11-08 |
| suricata |
ET MALWARE Bandit Stealer Host Details Exfil |
rev 1 |
2023-11-08 |
| suricata |
ET HUNTING HTTP GET Request for AutoItX3 |
rev 1 |
2023-11-08 |
| sigma |
F5 BIG-IP iControl Rest API Command Execution - Proxy |
test |
2023-11-08 |
| sigma |
F5 BIG-IP iControl Rest API Command Execution - Webserver |
test |
2023-11-08 |
| sigma |
CVE-2023-46747 Exploitation Activity - Webserver |
test |
2023-11-08 |
| sigma |
CVE-2023-46747 Exploitation Activity - Proxy |
test |
2023-11-08 |
| sigma |
Office Application Startup - Office Test |
test |
2023-11-08 |
| snort |
ET TROJAN Socks5SystemZ CnC Checkin Response M1 |
rev 1 |
2023-11-07 |
| snort |
ET TROJAN Socks5SystemZ CnC Checkin Response M2 |
rev 1 |
2023-11-07 |
| suricata |
ET MALWARE Socks5SystemZ CnC Checkin Response M1 |
rev 1 |
2023-11-07 |
| suricata |
ET MALWARE Socks5SystemZ CnC Checkin Response M2 |
rev 1 |
2023-11-07 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M2 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M1 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M2 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M1 Version 1.x-6.x |
rev 1 |
2023-11-06 |
| sigma |
HackTool - CrackMapExec Execution Patterns |
stable |
2023-11-06 |
| snort |
ET WEB_SERVER Tunna Variant Webshell Activity |
rev 2 |
2023-11-03 |
| snort |
ET CURRENT_EVENTS SWAT USA Drop Login Panel |
rev 1 |
2023-11-03 |
| suricata |
ET WEB_SERVER Tunna Variant Webshell Activity |
rev 2 |
2023-11-03 |
| sigma |
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback |
test |
2023-11-03 |
| snort |
ET TROJAN Suspected APT34 Related SSD Backdoor Response |
rev 1 |
2023-11-02 |
| elastic |
Deprecated - Potential Reverse Shell via Suspicious Parent Process |
deprecated |
2023-11-02 |
| snort |
ET TROJAN SockRacket/KANDYKORN CnC Response |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN GCleaner Downloader IP Address Retrieval Attempt M2 |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN SockRacket/KANDYKORN Client Challenge |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN GCleaner Downloader Activity M11 |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE GCleaner Downloader IP Address Retrieval Attempt M2 |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE SockRacket/KANDYKORN Client Challenge |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE GCleaner Downloader Activity M11 |
rev 1 |
2023-11-01 |
| suricata |
ET MALWARE SockRacket/KANDYKORN CnC Response |
rev 1 |
2023-11-01 |
| snort |
ET TROJAN Base64 Encoded MZ In Image |
rev 1 |
2023-10-31 |
| suricata |
ET MALWARE Base64 Encoded MZ In Image |
rev 1 |
2023-10-31 |