| suricata |
ET MOBILE_MALWARE Android/MMRAT CnC Checkin M2 |
rev 1 |
2023-09-13 |
| suricata |
ET MOBILE_MALWARE Android/MMRAT CnC Checkin M1 |
rev 1 |
2023-09-13 |
| snort |
ET TROJAN Reptile Linux LKM Rootkit Backdoor Activity |
rev 1 |
2023-09-12 |
| snort |
ET TROJAN TA406 Related Domain in DNS Lookup |
rev 1 |
2023-09-12 |
| snort |
ET TROJAN Observed TA406 Related Domain in TLS SNI |
rev 1 |
2023-09-12 |
| snort |
ET TROJAN Cobalt Strike Beacon Activity |
rev 3 |
2023-09-12 |
| snort |
ET CURRENT_EVENTS Sibhost Zip as Applet Archive July 08 2013 |
rev 4 |
2023-09-12 |
| suricata |
ET MALWARE Reptile Linux LKM Rootkit Backdoor Activity |
rev 1 |
2023-09-12 |
| suricata |
ET MALWARE Observed TA406 Related Domain in TLS SNI |
rev 1 |
2023-09-12 |
| suricata |
ET MALWARE TA406 Related Domain in DNS Lookup |
rev 1 |
2023-09-12 |
| sigma |
Winrar Compressing Dump Files |
test |
2023-09-12 |
| sigma |
Sysinternals Tools AppX Versions Execution |
test |
2023-09-12 |
| sigma |
Browser Execution In Headless Mode |
test |
2023-09-12 |
| sigma |
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE |
test |
2023-09-12 |
| snort |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| snort |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| snort |
ET USER_AGENTS Observed Reconnaissance Related UA |
rev 1 |
2023-09-11 |
| suricata |
ET USER_AGENTS Observed Reconnaissance Related UA |
rev 1 |
2023-09-11 |
| suricata |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| suricata |
ET INFO PhishingBox Landing Page - Phishing Simulation |
rev 1 |
2023-09-11 |
| sigma |
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE |
test |
2023-09-11 |
| sigma |
Application Termination Attempt via Wmic.EXE |
test |
2023-09-11 |
| sigma |
Chromium Browser Headless Execution To Mockbin Like Site |
test |
2023-09-11 |
| sigma |
Greedy File Deletion Using Del |
test |
2023-09-11 |
| sigma |
Fsutil Suspicious Invocation |
stable |
2023-09-09 |
| sigma |
Suspicious Scripting in a WMI Consumer |
test |
2023-09-09 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M3 |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Obfuscation Redirect Observed M2 |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M1 |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Password URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Check Add User URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M2 |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Check Expirations URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET TROJAN Red Wolf/RedCurl Payload Retrieval Attempt M4 |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Redirect URL Struct |
rev 1 |
2023-09-08 |
| snort |
ET CURRENT_EVENTS [TW] NOTG Obfuscation Redirect Observed M1 |
rev 1 |
2023-09-08 |
| snort |
ET INFO JSCAPE MFT - Binary Management Service Default TLS Certificate |
rev 1 |
2023-09-08 |
| snort |
ET INFO JSCAPE MFT - HTTP Management Service Detected via Set-Cookie |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Obfuscation Redirect Observed M1 |
rev 1 |
2023-09-08 |
| suricata |
ET PHISHING [TW] NOTG Redirect URL Struct |
rev 1 |
2023-09-08 |