| sigma |
HackTool - DiagTrackEoP Default Named Pipe |
test |
2023-08-07 |
| sigma |
PsExec Service Installation |
test |
2023-08-04 |
| sigma |
Potential Mpclient.DLL Sideloading Via Defender Binaries |
test |
2023-08-04 |
| sigma |
CSExec Service File Creation |
test |
2023-08-04 |
| sigma |
RemCom Service File Creation |
test |
2023-08-04 |
| sigma |
Potential Mpclient.DLL Sideloading |
test |
2023-08-04 |
| sigma |
Potential AVKkid.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Mfdetours.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Vivaldi_elf.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Linux Amazon SSM Agent Hijacking |
test |
2023-08-03 |
| sigma |
Potential EACore.DLL Sideloading |
test |
2023-08-03 |
| sigma |
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution |
test |
2023-08-03 |
| sigma |
Potential Mftrace.EXE Abuse |
test |
2023-08-03 |
| sigma |
Potential Binary Proxy Execution Via VSDiagnostics.EXE |
test |
2023-08-03 |
| snort |
ET WEB_SPECIFIC_APPS Metabase Setup-Token Information Disclosure - Required for CVE-2023-38646 |
rev 1 |
2023-08-02 |
| snort |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M1 |
rev 2 |
2023-08-02 |
| snort |
ET INFO Veeam Credential Recovery Script Inbound |
rev 1 |
2023-08-02 |
| snort |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2 |
rev 2 |
2023-08-02 |
| suricata |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2 |
rev 2 |
2023-08-02 |
| suricata |
ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M1 |
rev 2 |
2023-08-02 |
| suricata |
ET WEB_SPECIFIC_APPS Metabase Setup-Token Information Disclosure - Required for CVE-2023-38646 |
rev 1 |
2023-08-02 |
| suricata |
ET HUNTING Veeam Credential Recovery Script Inbound |
rev 1 |
2023-08-02 |
| sigma |
Dynamic .NET Compilation Via Csc.EXE - Hunting |
test |
2023-08-02 |
| sigma |
Potential Amazon SSM Agent Hijacking |
test |
2023-08-02 |
| snort |
ET TROJAN Javascript Initiating Remote Server Search with Window's Search-MS URI Handler |
rev 1 |
2023-08-01 |
| suricata |
ET EXPLOIT Javascript Initiating Remote Server Search with Window's Search-MS URI Handler |
rev 1 |
2023-08-01 |
| elastic |
Suspicious Network Connection Attempt by Root |
deprecated |
2023-07-31 |
| snort |
ET TROJAN PennyWise Stealer Data Exfil M4 |
rev 1 |
2023-07-28 |
| snort |
ET TROJAN PennyWise Stealer Data Exfil M2 |
rev 4 |
2023-07-28 |
| suricata |
ET MALWARE PennyWise Stealer Data Exfil M2 |
rev 4 |
2023-07-28 |
| suricata |
ET MALWARE PennyWise Stealer Data Exfil M4 |
rev 1 |
2023-07-28 |
| sigma |
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request |
test |
2023-07-28 |
| sigma |
Potential CVE-2023-27997 Exploitation Indicators |
test |
2023-07-28 |
| sigma |
Data Compressed |
test |
2023-07-28 |
| snort |
ET TROJAN Pupy RAT Default TLS Proxy Certificate |
rev 1 |
2023-07-27 |
| snort |
ET TROJAN [ANY.RUN] Hydrochasma Fast Reverse Proxy M3 |
rev 1 |
2023-07-27 |
| snort |
ET TROJAN MalDoc/Gamaredon CnC Activity M4 |
rev 1 |
2023-07-27 |
| suricata |
ET MALWARE Pupy RAT Default TLS Proxy Certificate |
rev 1 |
2023-07-27 |
| suricata |
ET MALWARE MalDoc/Gamaredon CnC Activity M4 |
rev 1 |
2023-07-27 |
| sigma |
Suspicious File Download From IP Via Wget.EXE |
test |
2023-07-27 |