| snort |
ET TROJAN [ANY.RUN] Mekotio Banking Trojan TCP Request |
rev 1 |
2023-08-24 |
| snort |
ET TROJAN Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| snort |
ET TROJAN Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Observed TA444 Domain in TLS SNI |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Observed TA444 Domain in TLS SNI |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE CobaltStrike SMB P2P Default Msagent Named Pipe Interaction |
rev 4 |
2023-08-24 |
| suricata |
ET MALWARE [ANY.RUN] Mekotio Banking Trojan TCP Request |
rev 1 |
2023-08-24 |
| suricata |
ET MALWARE Covenant .NET Framework P2P C&C Protocol Gruntsvc Named Pipe Interaction |
rev 2 |
2023-08-24 |
| suricata |
ET MALWARE Observed DNS Query to TA444 Domain |
rev 1 |
2023-08-24 |
| snort |
ET TROJAN Carderbee APT Related Activity |
rev 1 |
2023-08-23 |
| snort |
ET TROJAN Win32/PlugX Variant CnC Activity |
rev 2 |
2023-08-23 |
| suricata |
ET MALWARE Win32/PlugX Variant CnC Activity |
rev 2 |
2023-08-23 |
| suricata |
ET MALWARE Carderbee APT Related Activity |
rev 1 |
2023-08-23 |
| sigma |
Suspicious Execution Location Of Wermgr.EXE |
test |
2023-08-23 |
| sigma |
Container Residence Discovery Via Proc Virtual FS |
test |
2023-08-23 |
| sigma |
Docker Container Discovery Via Dockerenv Listing |
test |
2023-08-23 |
| sigma |
Devil Bait Potential C2 Communication Traffic |
test |
2023-08-23 |
| sigma |
SCR File Write Event |
test |
2023-08-23 |
| sigma |
Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location |
test |
2023-08-23 |
| sigma |
Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution |
test |
2023-08-23 |
| snort |
ET TROJAN Laplas Clipper - GetAddress CnC Checkin |
rev 4 |
2023-08-22 |
| snort |
ET TROJAN Laplas Clipper - SetOnline CnC Checkin |
rev 4 |
2023-08-22 |
| snort |
ET TROJAN Win32/Gomorrah Stealer Data Exfiltration |
rev 5 |
2023-08-22 |
| snort |
ET TROJAN Laplas Clipper - Regex CnC Request |
rev 5 |
2023-08-22 |
| suricata |
ET MALWARE Laplas Clipper - Regex CnC Request |
rev 5 |
2023-08-22 |
| suricata |
ET MALWARE Laplas Clipper - GetAddress CnC Checkin |
rev 4 |
2023-08-22 |
| suricata |
ET MALWARE Laplas Clipper - SetOnline CnC Checkin |
rev 4 |
2023-08-22 |
| sigma |
ESXi Account Creation Via ESXCLI |
test |
2023-08-22 |
| sigma |
Potential In-Memory Download And Compile Of Payloads |
test |
2023-08-22 |
| sigma |
Python Function Execution Security Warning Disabled In Excel |
test |
2023-08-22 |
| sigma |
Anonymous IP Address |
test |
2023-08-22 |
| sigma |
User Added To Admin Group Via DseditGroup |
test |
2023-08-22 |
| sigma |
Root Account Enable Via Dsenableroot |
test |
2023-08-22 |
| sigma |
Masquerading as Linux Crond Process |
test |
2023-08-22 |
| sigma |
JAMF MDM Potential Suspicious Child Process |
test |
2023-08-22 |
| sigma |
JAMF MDM Execution |
test |
2023-08-22 |
| sigma |
WebDAV Temporary Local File Creation |
test |
2023-08-21 |
| sigma |
Potentially Suspicious WebDAV LNK Execution |
test |
2023-08-21 |
| sigma |
Wdigest Enable UseLogonCredential |
test |
2023-08-17 |