| suricata |
ET WEB_CLIENT Possible Embedded NTLM Hash Theft Code |
rev 3 |
2023-10-11 |
| suricata |
ET INFO Observed Pastebin Style Domain in TLS SNI |
rev 1 |
2023-10-11 |
| sigma |
Google Workspace User Granted Admin Privileges |
test |
2023-10-11 |
| sigma |
Google Workspace Application Removed |
test |
2023-10-11 |
| sigma |
Google Workspace MFA Disabled |
test |
2023-10-11 |
| sigma |
Google Workspace Role Privilege Deleted |
test |
2023-10-11 |
| sigma |
Google Workspace Role Modified or Deleted |
test |
2023-10-11 |
| sigma |
Number Of Resource Creation Or Deployment Activities |
test |
2023-10-11 |
| sigma |
Rare Subscription-level Operations In Azure |
test |
2023-10-11 |
| sigma |
Google Workspace Granted Domain API Access |
test |
2023-10-11 |
| sigma |
Granting Of Permissions To An Account |
test |
2023-10-11 |
| sigma |
Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader |
test |
2023-10-11 |
| sigma |
HackTool - CoercedPotato Named Pipe Creation |
test |
2023-10-11 |
| sigma |
Control Panel Items |
test |
2023-10-11 |
| snort |
ET CURRENT_EVENTS MageCart 404 COOKIE_ANNOT |
rev 1 |
2023-10-10 |
| snort |
ET INFO LNK File Downloaded via HTTP |
rev 1 |
2023-10-10 |
| suricata |
ET PHISHING MageCart 404 COOKIE_ANNOT |
rev 1 |
2023-10-10 |
| sigma |
Remote Access Tool - ScreenConnect Temporary File |
test |
2023-10-10 |
| sigma |
Remote Access Tool - ScreenConnect Command Execution |
test |
2023-10-10 |
| sigma |
Remote Access Tool - ScreenConnect File Transfer |
test |
2023-10-10 |
| snort |
ET INFO ISO File Downloaded |
rev 1 |
2023-10-09 |
| suricata |
ET INFO ISO File Downloaded |
rev 1 |
2023-10-09 |
| sigma |
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI |
test |
2023-10-09 |
| sigma |
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream |
test |
2023-10-09 |
| snort |
ET TROJAN Ursnif Payload Downloader Inbound |
rev 1 |
2023-10-06 |
| snort |
ET CURRENT_EVENTS JavaScript DOS Injection |
rev 1 |
2023-10-06 |
| suricata |
ET MALWARE Ursnif Payload Downloader Inbound |
rev 1 |
2023-10-06 |
| snort |
ET TROJAN LNK/Sherlock Stealer Payload Inbound |
rev 1 |
2023-10-05 |
| suricata |
ET MALWARE LNK/Sherlock Stealer Payload Inbound |
rev 1 |
2023-10-05 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M1 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN Observed BlackDolphin Ransomware Builder Cookie |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M3 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M2 |
rev 1 |
2023-10-04 |
| snort |
ET TROJAN BlackDolphin Ransomware Builder Landing Page M4 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M1 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M3 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M4 |
rev 1 |
2023-10-04 |
| suricata |
ET MALWARE BlackDolphin Ransomware Builder Landing Page M2 |
rev 1 |
2023-10-04 |
| snort |
ET CURRENT_EVENTS [TW] Trex Phishkit POST |
rev 1 |
2023-10-03 |
| suricata |
ET MALWARE Observed BlackDolphin Ransomware Builder Cookie |
rev 1 |
2023-10-03 |