| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-series Possible Unauthorized Access - Request for home.sel |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IGMP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - UDP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3530-RTAC AcSELerator Firmware Activity |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Heap Memory Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation System Data Details Information Disclosure Attempt |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-series Dropbear SSH Banner - Possible SSH Login attempt |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-3620 Default Cert Issuer Common Name |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboraties SEL-series Possible Unauthorized Access Attempt - Request for err401.sel |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - System List |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Chassis Detail Request |
rev 1 |
2023-10-18 |
| sigma |
Arbitrary File Download Via GfxDownloadWrapper.EXE |
test |
2023-10-18 |
| sigma |
File Download From IP Based URL Via CertOC.EXE |
test |
2023-10-18 |
| sigma |
File Download via CertOC.EXE |
test |
2023-10-18 |
| sigma |
PowerShell Script Execution Policy Enabled |
test |
2023-10-18 |
| sigma |
Suspicious LNK Double Extension File Created |
test |
2023-10-18 |
| sigma |
File Download From IP URL Via Curl.EXE |
test |
2023-10-18 |
| sigma |
ADSI-Cache File Creation By Uncommon Tool |
test |
2023-10-18 |
| sigma |
Potentially Suspicious Office Document Executed From Trusted Location |
test |
2023-10-18 |
| sigma |
Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly |
test |
2023-10-17 |
| sigma |
Rundll32.EXE Calling DllRegisterServer Export Function Explicitly |
test |
2023-10-17 |
| sigma |
DarkGate - User Created Via Net.EXE |
test |
2023-10-15 |
| sigma |
DarkGate - Autoit3.EXE Execution Parameters |
test |
2023-10-15 |
| sigma |
DarkGate - Autoit3.EXE File Creation By Uncommon Process |
test |
2023-10-15 |
| sigma |
Potential Webshell Creation On Static Website |
test |
2023-10-15 |
| snort |
ET WEB_SERVER Generic PHP Webshell Activity |
rev 1 |
2023-10-13 |
| suricata |
ET WEB_SERVER Generic PHP Webshell Activity |
rev 1 |
2023-10-13 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Attempt |
rev 1 |
2023-10-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Success |
rev 1 |
2023-10-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Attempt |
rev 1 |
2023-10-12 |
| snort |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Success |
rev 1 |
2023-10-12 |
| snort |
ET TROJAN Win32/MataDoor CnC Beacon Over UDP |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Success |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 1/2 Attempt |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Success |
rev 1 |
2023-10-12 |
| suricata |
ET WEB_SPECIFIC_APPS Atlassian Confluence CVE-2023-22515 Step 2/2 Attempt |
rev 1 |
2023-10-12 |
| suricata |
ET MALWARE Win32/MataDoor CnC Beacon Over UDP |
rev 1 |
2023-10-12 |
| sigma |
Renamed CURL.EXE Execution |
test |
2023-10-12 |
| snort |
ET WEB_CLIENT Possible Embedded NTLM Hash Theft Code |
rev 3 |
2023-10-11 |
| snort |
ET INFO Observed Pastebin Style Domain in TLS SNI |
rev 1 |
2023-10-11 |