| snort |
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2 |
rev 3 |
2023-09-21 |
| snort |
ET TROJAN Observed DNS Query to Win32/TrojanDropper.Agent.SLC Domain |
rev 2 |
2023-09-20 |
| sigma |
PsExec Tool Execution From Suspicious Locations - PipeName |
test |
2023-09-20 |
| snort |
ET TROJAN NewsPenguin CnC Checkin |
rev 2 |
2023-09-19 |
| snort |
ET TROJAN Suspected Periscope Framework Agent Related Activity |
rev 1 |
2023-09-19 |
| suricata |
ET MALWARE NewsPenguin CnC Checkin |
rev 3 |
2023-09-19 |
| sigma |
OneNote Attachment File Dropped In Suspicious Location |
test |
2023-09-19 |
| sigma |
Leviathan Registry Key Activity |
test |
2023-09-19 |
| snort |
ET TROJAN DarkGate AutoIt Downloader |
rev 2 |
2023-09-18 |
| snort |
ET TROJAN Blue Bot DDoS Proxy Request |
rev 6 |
2023-09-18 |
| snort |
ET POLICY Observed MSI Download |
rev 3 |
2023-09-18 |
| sigma |
New Federated Domain Added |
test |
2023-09-18 |
| sigma |
DNS Query To MEGA Hosting Website |
test |
2023-09-18 |
| sigma |
DNS Query To Ufile.io - DNS Client |
test |
2023-09-18 |
| sigma |
Remote DLL Load Via Rundll32.EXE |
test |
2023-09-18 |
| sigma |
DLL Load By System Process From Suspicious Locations |
test |
2023-09-18 |
| sigma |
Uncommon Child Process Of AddinUtil.EXE |
test |
2023-09-18 |
| sigma |
Suspicious AddinUtil.EXE CommandLine Execution |
test |
2023-09-18 |
| sigma |
Uncommon AddinUtil.EXE CommandLine Execution |
test |
2023-09-18 |
| sigma |
Network Connection Initiated By Regsvr32.EXE |
test |
2023-09-18 |
| sigma |
TeamViewer Domain Query By Non-TeamViewer Application |
test |
2023-09-18 |
| sigma |
DNS Query Request By Regsvr32.EXE |
test |
2023-09-18 |
| sigma |
Suspicious WebDav Client Execution Via Rundll32.EXE |
test |
2023-09-18 |
| sigma |
DNS Server Discovery Via LDAP Query |
test |
2023-09-18 |
| sigma |
DNS Query To Ufile.io |
test |
2023-09-18 |
| sigma |
WebDav Client Execution Via Rundll32.EXE |
test |
2023-09-18 |
| sigma |
Disabling Multi Factor Authentication |
test |
2023-09-18 |
| sigma |
Sysmon Blocked Executable |
test |
2023-09-16 |
| suricata |
ET MALWARE DarkGate AutoIt Downloader |
rev 1 |
2023-09-15 |
| sigma |
Potentially Suspicious Child Process Of DiskShadow.EXE |
test |
2023-09-15 |
| sigma |
Diskshadow Child Process Spawned |
test |
2023-09-15 |
| sigma |
Roles Activated Too Frequently |
test |
2023-09-14 |
| sigma |
Invalid PIM License |
test |
2023-09-14 |
| sigma |
Roles Assigned Outside PIM |
test |
2023-09-14 |
| sigma |
Roles Activation Doesn't Require MFA |
test |
2023-09-14 |
| sigma |
Roles Are Not Being Used |
test |
2023-09-14 |
| sigma |
Stale Accounts In A Privileged Role |
test |
2023-09-14 |
| sigma |
Too Many Global Admins |
test |
2023-09-14 |
| snort |
ET TROJAN Android/MMRAT CnC Checkin M1 |
rev 1 |
2023-09-13 |
| snort |
ET TROJAN Android/MMRAT CnC Checkin M2 |
rev 1 |
2023-09-13 |