| snort |
ET TROJAN APT29 Duke Variant Malware CnC Checkin Observed |
rev 1 |
2023-08-14 |
| snort |
ET TROJAN APT29 HTA Dropper Checkin Observed |
rev 1 |
2023-08-14 |
| suricata |
ET ADWARE_PUP Tenorshare Google Analytics Checkin |
rev 2 |
2023-08-14 |
| suricata |
ET MALWARE APT29 HTA Dropper Checkin Observed |
rev 1 |
2023-08-14 |
| suricata |
ET MALWARE APT29 Duke Variant Malware CnC Checkin Observed |
rev 1 |
2023-08-14 |
| sigma |
Assembly DLL Creation Via AspNetCompiler |
test |
2023-08-14 |
| sigma |
Suspicious Child Process of AspNetCompiler |
test |
2023-08-14 |
| snort |
ET TROJAN Filez Downloader Checkin |
rev 1 |
2023-08-11 |
| sigma |
Unsigned Mfdetours.DLL Sideloading |
test |
2023-08-11 |
| snort |
ET TROJAN VBS/Kimsuky UA Observed |
rev 3 |
2023-08-10 |
| snort |
ET TROJAN Reptile Rootkit Default TCP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| snort |
ET TROJAN Reptile Rootkit Default ICMP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| snort |
ET TROJAN Reptile Rootkit Default UDP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| snort |
ET TROJAN [ANY.RUN] Parallax RAT Check-In |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Reptile Rootkit Default UDP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE [ANY.RUN] Parallax RAT Check-In |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Reptile Rootkit Default ICMP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Reptile Rootkit Default TCP Magic Packet Trigger |
rev 1 |
2023-08-09 |
| suricata |
ET MALWARE Observed TA401 Related Domain in TLS SNI |
rev 1 |
2023-08-09 |
| sigma |
Renamed Gpg.EXE Execution |
test |
2023-08-09 |
| sigma |
File Decryption Using Gpg4win |
test |
2023-08-09 |
| sigma |
File Encryption Using Gpg4win |
test |
2023-08-09 |
| sigma |
File Encryption/Decryption Via Gpg4win From Suspicious Locations |
test |
2023-08-09 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.servehttp .com Domain |
rev 3 |
2023-08-08 |
| suricata |
ET HUNTING Generic .bin download from Dotted Quad |
rev 13 |
2023-08-08 |
| sigma |
Potential Provlaunch.EXE Binary Proxy Execution Abuse |
test |
2023-08-08 |
| sigma |
Potential Provisioning Registry Key Abuse For Binary Proxy Execution |
test |
2023-08-08 |
| sigma |
Suspicious Provlaunch.EXE Child Process |
test |
2023-08-08 |
| snort |
ET CURRENT_EVENTS Parrot TDS Check M2 |
rev 1 |
2023-08-07 |
| snort |
ET TROJAN Redis-p2pinfect TLS Certificate Serial Number Observed in SSL Certificate |
rev 1 |
2023-08-07 |
| snort |
ET TROJAN [ANY.RUN] Phemedrone Stealer Exfiltration via Telegram |
rev 1 |
2023-08-07 |
| suricata |
ET MALWARE Redis-p2pinfect TLS Certificate Serial Number Observed in SSL Certificate |
rev 1 |
2023-08-07 |
| sigma |
CSExec Service Installation |
test |
2023-08-07 |
| sigma |
RemCom Service Installation |
test |
2023-08-07 |
| sigma |
HackTool Service Registration or Execution |
test |
2023-08-07 |
| sigma |
Malicious Named Pipe Created |
test |
2023-08-07 |
| sigma |
HackTool - Credential Dumping Tools Named Pipe Created |
test |
2023-08-07 |
| sigma |
HackTool - DiagTrackEoP Default Named Pipe |
test |
2023-08-07 |
| sigma |
Injected Browser Process Spawning Rundll32 - GuLoader Activity |
test |
2023-08-07 |
| sigma |
HackTool - Koh Default Named Pipe |
test |
2023-08-07 |