| suricata |
ET MALWARE Observed BlackDolphin Ransomware Builder Cookie |
rev 1 |
2023-10-03 |
| sigma |
Uncommon Microsoft Office Trusted Location Added |
test |
2023-09-29 |
| sigma |
Potential Recon Activity Using DriverQuery.EXE |
test |
2023-09-29 |
| sigma |
DriverQuery.EXE Execution |
test |
2023-09-29 |
| sigma |
Potentially Suspicious Event Viewer Child Process |
test |
2023-09-28 |
| sigma |
Service Registry Key Read Access Request |
test |
2023-09-28 |
| sigma |
UAC Bypass via Event Viewer |
test |
2023-09-28 |
| sigma |
OceanLotus Registry Activity |
test |
2023-09-28 |
| sigma |
COM Hijack via Sdclt |
test |
2023-09-28 |
| snort |
ET TROJAN Win32/Gh0stRat C2 Checkin |
rev 1 |
2023-09-27 |
| snort |
ET TROJAN TA444 MacOS/ProcessRequest CnC Checkin |
rev 1 |
2023-09-27 |
| suricata |
ET MALWARE Win32/Gh0stRat C2 Checkin |
rev 1 |
2023-09-27 |
| suricata |
ET MALWARE TA444 MacOS/ProcessRequest CnC Checkin |
rev 1 |
2023-09-27 |
| sigma |
AWS Identity Center Identity Provider Change |
test |
2023-09-27 |
| sigma |
Scheduled Task Created - Registry |
test |
2023-09-27 |
| sigma |
Scheduled Task Created - FileCreation |
test |
2023-09-27 |
| snort |
ET TROJAN Alloy Taurus APT Zapoa Backdoor Activity |
rev 1 |
2023-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to softether .net Domain |
rev 1 |
2023-09-26 |
| snort |
ET TROJAN Alloy Taurus Reshell Backdoor URI pattern Observed M2 |
rev 1 |
2023-09-26 |
| snort |
ET TROJAN Alloy Taurus Reshell Backdoor URI pattern Observed M1 |
rev 1 |
2023-09-26 |
| suricata |
ET MALWARE Alloy Taurus Reshell Backdoor URI pattern Observed M1 |
rev 1 |
2023-09-26 |
| suricata |
ET MALWARE Alloy Taurus Reshell Backdoor URI pattern Observed M2 |
rev 1 |
2023-09-26 |
| suricata |
ET MALWARE Alloy Taurus APT Zapoa Backdoor Activity |
rev 1 |
2023-09-26 |
| sigma |
Linux Network Service Scanning - Auditd |
test |
2023-09-26 |
| snort |
ET TROJAN Possible OwlProxy activity M3 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M4 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M5 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M6 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Possible OwlProxy activity M2 |
rev 1 |
2023-09-25 |
| snort |
ET TROJAN Observed DNS Query to TA455 Domain |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M3 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M6 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M2 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M4 |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Observed DNS Query to TA455 Domain |
rev 1 |
2023-09-25 |
| suricata |
ET MALWARE Possible OwlProxy activity M5 |
rev 1 |
2023-09-25 |
| elastic |
Deprecated - Potential DNS Tunneling via Iodine |
deprecated |
2023-09-25 |
| elastic |
Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable |
deprecated |
2023-09-25 |
| snort |
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2 |
rev 3 |
2023-09-21 |
| snort |
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M1 |
rev 2 |
2023-09-21 |