| suricata |
ET MALWARE Base64 Encoded MZ In Image |
rev 1 |
2023-10-31 |
| snort |
ET TROJAN Possible Konni RAT Related Activity Observed |
rev 1 |
2023-10-30 |
| snort |
ET TROJAN Suspected Bumblebee Loader Activity |
rev 1 |
2023-10-30 |
| suricata |
ET MALWARE Possible Konni RAT Related Activity Observed |
rev 1 |
2023-10-30 |
| sigma |
Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy |
test |
2023-10-30 |
| sigma |
Potential Information Disclosure CVE-2023-43261 Exploitation - Web |
test |
2023-10-30 |
| sigma |
Suspicious Unsigned Thor Scanner Execution |
stable |
2023-10-29 |
| sigma |
AWS S3 Bucket Versioning Disable |
test |
2023-10-28 |
| snort |
ET TROJAN Win32/NewsRat CnC Response |
rev 1 |
2023-10-27 |
| suricata |
ET MALWARE Win32/NewsRat CnC Response |
rev 1 |
2023-10-27 |
| sigma |
PowerShell Called from an Executable Version Mismatch |
test |
2023-10-27 |
| sigma |
Use Get-NetTCPConnection |
test |
2023-10-27 |
| sigma |
PowerShell Downgrade Attack - PowerShell |
test |
2023-10-27 |
| sigma |
Netcat The Powershell Version |
test |
2023-10-27 |
| sigma |
Delete Volume Shadow Copies Via WMI With PowerShell |
stable |
2023-10-27 |
| snort |
ET INFO Smocker Server Mock Tool Response |
rev 1 |
2023-10-25 |
| snort |
ET TROJAN Volt Typhoon User-Agent |
rev 1 |
2023-10-25 |
| snort |
ET TROJAN Golang Easy Stealer CnC Response |
rev 2 |
2023-10-25 |
| suricata |
ET MALWARE Volt Typhoon User-Agent |
rev 1 |
2023-10-25 |
| sigma |
Visual Studio Code Tunnel Shell Execution |
test |
2023-10-25 |
| sigma |
Visual Studio Code Tunnel Service Installation |
test |
2023-10-25 |
| sigma |
Potentially Suspicious Child Process Of VsCode |
test |
2023-10-25 |
| sigma |
Visual Studio Code Tunnel Remote File Creation |
test |
2023-10-25 |
| sigma |
Renamed VsCode Code Tunnel Execution - File Indicator |
test |
2023-10-25 |
| sigma |
Okta Admin Functions Access Through Proxy |
test |
2023-10-25 |
| sigma |
VsCode Code Tunnel Execution File Indicator |
test |
2023-10-25 |
| sigma |
Okta Password Health Report Query |
test |
2023-10-25 |
| sigma |
Diamond Sleet APT DNS Communication Indicators |
test |
2023-10-24 |
| sigma |
Onyx Sleet APT File Creation Indicators |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT DLL Sideloading Indicators |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT Scheduled Task Creation |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT File Creation Indicators |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT Process Activity Indicators |
test |
2023-10-24 |
| sigma |
Diamond Sleet APT Scheduled Task Creation - Registry |
test |
2023-10-24 |
| sigma |
Security Software Discovery Via Powershell Script |
test |
2023-10-24 |
| snort |
ET TROJAN LUMAR Stealer Exfiltration M2 |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default X509 Certificate |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium Niagara Default Cert Issuer Common Name |
rev 1 |
2023-10-23 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Tridium NiagaraN4 Default Cert Subject Common Name |
rev 1 |
2023-10-23 |