| sigma |
Windows Defender Exclusions Added - Registry |
test |
2023-08-17 |
| sigma |
Potential Registry Persistence Attempt Via DbgManagedDebugger |
test |
2023-08-17 |
| sigma |
Custom File Open Handler Executes PowerShell |
test |
2023-08-17 |
| sigma |
CrashControl CrashDump Disabled |
test |
2023-08-17 |
| sigma |
ClickOnce Trust Prompt Tampering |
test |
2023-08-17 |
| sigma |
IE Change Domain Zone |
test |
2023-08-17 |
| sigma |
Bypass UAC Using Event Viewer |
test |
2023-08-17 |
| sigma |
Blue Mockingbird - Registry |
test |
2023-08-17 |
| sigma |
CVE-2021-31979 CVE-2021-33771 Exploits |
test |
2023-08-17 |
| sigma |
Suspicious Set Value of MSDT in Registry (CVE-2022-30190) |
test |
2023-08-17 |
| sigma |
Potential Encrypted Registry Blob Related To SNAKE Malware |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Mpnotify |
test |
2023-08-17 |
| sigma |
New DNS ServerLevelPluginDll Installed |
test |
2023-08-17 |
| sigma |
DNS-over-HTTPS Enabled by Registry |
test |
2023-08-17 |
| sigma |
Persistence Via Disk Cleanup Handler - Autorun |
test |
2023-08-17 |
| sigma |
Add DisallowRun Execution to Registry |
test |
2023-08-17 |
| sigma |
Disable Tamper Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Disable PUA Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Disabled Windows Defender Eventlog |
test |
2023-08-17 |
| sigma |
Disable Exploit Guard Network Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Registry Disable System Restore |
test |
2023-08-17 |
| sigma |
Small Sieve Malware Registry Persistence |
test |
2023-08-17 |
| sigma |
Disable Windows Security Center Notifications |
test |
2023-08-17 |
| sigma |
Disable Windows Firewall by Registry |
test |
2023-08-17 |
| sigma |
Disable Privacy Settings Experience in Registry |
test |
2023-08-17 |
| sigma |
Running Chrome VPN Extensions via the Registry 2 VPN Extension |
test |
2023-08-17 |
| sigma |
Wow6432Node Classes Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
System Scripts Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
Session Manager Autorun Keys Modification |
test |
2023-08-17 |
| sigma |
WinSock2 Autorun Keys Modification |
test |
2023-08-17 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-08-09 |
rev 1 |
2023-08-16 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-08-09 |
rev 1 |
2023-08-16 |
| sigma |
Suspicious Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
Uncommon Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
New BgInfo.EXE Custom DB Path Registry Configuration |
test |
2023-08-16 |
| sigma |
New BgInfo.EXE Custom WMI Query Registry Configuration |
test |
2023-08-16 |
| sigma |
New BgInfo.EXE Custom VBScript Registry Configuration |
test |
2023-08-16 |
| sigma |
WSL Child Process Anomaly |
test |
2023-08-15 |
| sigma |
Indirect Inline Command Execution Via Bash.EXE |
test |
2023-08-15 |
| sigma |
Indirect Command Execution From Script File Via Bash.EXE |
test |
2023-08-15 |