| sigma |
Activity From Anonymous IP Address |
test |
2023-09-03 |
| sigma |
Anomalous User Activity |
test |
2023-09-03 |
| sigma |
Suspicious Inbox Manipulation Rules |
test |
2023-09-03 |
| sigma |
Suspicious Inbox Forwarding Identity Protection |
test |
2023-09-03 |
| sigma |
Impossible Travel |
test |
2023-09-03 |
| sigma |
Atypical Travel |
test |
2023-09-03 |
| sigma |
Azure AD Account Credential Leaked |
test |
2023-09-03 |
| sigma |
Sign-In From Malware Infected IP |
test |
2023-09-03 |
| snort |
ET CURRENT_EVENTS Facebook Credential Phish Landing Page 2023-09-01 |
rev 1 |
2023-09-01 |
| snort |
ET TROJAN [ANY.RUN] Konni.APT Exfiltration |
rev 1 |
2023-09-01 |
| snort |
ET TROJAN Win32/RisePro CnC Server Response M4 |
rev 3 |
2023-09-01 |
| snort |
ET MOBILE_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration |
rev 1 |
2023-09-01 |
| snort |
ET TROJAN [ANY.RUN] Konni.APT Keep-Alive |
rev 1 |
2023-09-01 |
| suricata |
ET PHISHING Facebook Credential Phish Landing Page 2023-09-01 |
rev 1 |
2023-09-01 |
| sigma |
Qakbot Uninstaller Execution |
test |
2023-09-01 |
| sigma |
New Port Forwarding Rule Added Via Netsh.EXE |
test |
2023-09-01 |
| sigma |
CVE-2023-40477 Potential Exploitation - WinRAR Application Crash |
test |
2023-08-31 |
| sigma |
CVE-2023-40477 Potential Exploitation - .REV File Creation |
test |
2023-08-31 |
| sigma |
IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32 |
test |
2023-08-31 |
| sigma |
Potentially Suspicious Child Process Of WinRAR.EXE |
test |
2023-08-31 |
| sigma |
Path Traversal Exploitation Attempts |
test |
2023-08-31 |
| sigma |
Rundll32 Execution Without CommandLine Parameters |
test |
2023-08-31 |
| sigma |
Rundll32 Spawned Via Explorer.EXE |
test |
2023-08-31 |
| sigma |
CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File |
test |
2023-08-30 |
| snort |
ET TROJAN [ANY.RUN] Win32/RootTeam Stealer CnC Exfil M3 |
rev 2 |
2023-08-29 |
| sigma |
Potentially Suspicious Compression Tool Parameters |
test |
2023-08-29 |
| sigma |
LSASS Dump Keyword In CommandLine |
test |
2023-08-29 |
| sigma |
LOLBIN Execution From Abnormal Drive |
test |
2023-08-29 |
| sigma |
Suspicious Child Process Of Manage Engine ServiceDesk |
test |
2023-08-29 |
| snort |
ET TROJAN MacOS/Adload CnC Beacon |
rev 2 |
2023-08-28 |
| snort |
ET INFO WebDAV Retrieving .exe |
rev 1 |
2023-08-25 |
| snort |
ET INFO WebDAV Retrieving .dll |
rev 1 |
2023-08-25 |
| snort |
ET MALWARE Suspected Adware/AccessMembre Checkin M2 |
rev 1 |
2023-08-25 |
| snort |
ET MALWARE Suspected Adware/AccessMembre Checkin M3 |
rev 1 |
2023-08-25 |
| snort |
ET TROJAN ReverseLoader Reverse Base64 Encoded Executable In Image M1 |
rev 1 |
2023-08-25 |
| suricata |
ET ADWARE_PUP Suspected Adware/AccessMembre Checkin M2 |
rev 1 |
2023-08-25 |
| suricata |
ET ADWARE_PUP Suspected Adware/AccessMembre Checkin M3 |
rev 1 |
2023-08-25 |
| suricata |
ET MALWARE ReverseLoader Reverse Base64 Encoded Executable In Image M1 |
rev 1 |
2023-08-25 |
| snort |
ET TROJAN Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| snort |
ET TROJAN Covenant .NET Framework P2P C&C Protocol Gruntsvc Named Pipe Interaction |
rev 3 |
2023-08-24 |