| sigma |
Potential Cookies Session Hijacking |
test |
2023-07-27 |
| sigma |
Insecure Proxy/DOH Transfer Via Curl.EXE |
test |
2023-07-27 |
| sigma |
Local File Read Using Curl.EXE |
test |
2023-07-27 |
| sigma |
Suspicious File Download From IP Via Curl.EXE |
test |
2023-07-27 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 4 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 4 |
rev 3 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 2 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 1 |
rev 10 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT CnC 24 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 1 |
rev 2 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 2 |
rev 10 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT CnC 23 |
rev 1 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive Response 3 |
rev 6 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT Keepalive 3 |
rev 3 |
2023-07-26 |
| snort |
ET TROJAN NanoCore RAT CnC 7 |
rev 2 |
2023-07-26 |
| suricata |
ET MALWARE NanoCore RAT CnC 24 |
rev 2 |
2023-07-26 |
| suricata |
ET MALWARE NanoCore RAT CnC 7 |
rev 2 |
2023-07-26 |
| suricata |
ET MALWARE NanoCore RAT CnC 23 |
rev 1 |
2023-07-26 |
| snort |
ET USER_AGENTS Kimsuky CnC Checkin User-Agent |
rev 1 |
2023-07-25 |
| sigma |
VMToolsd Suspicious Child Process |
test |
2023-07-25 |
| sigma |
Windows Internet Hosted WebDav Share Mount Via Net.EXE |
test |
2023-07-25 |
| sigma |
Windows Terminal Profile Settings Modification By Uncommon Process |
test |
2023-07-22 |
| snort |
ET TROJAN Win32/IcedID Request Cookie |
rev 5 |
2023-07-21 |
| suricata |
ET MALWARE Win32/IcedID Request Cookie |
rev 4 |
2023-07-21 |
| sigma |
WinAPI Function Calls Via PowerShell Scripts |
test |
2023-07-21 |
| sigma |
WinAPI Library Calls Via PowerShell Scripts |
test |
2023-07-21 |
| sigma |
SMB over QUIC Via PowerShell Script |
test |
2023-07-21 |
| sigma |
SMB over QUIC Via Net.EXE |
test |
2023-07-21 |
| snort |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| snort |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| suricata |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| suricata |
ET EXPLOIT Possible PaulPrinting CMS Cross-Site Scripting - Inbound |
rev 1 |
2023-07-20 |
| sigma |
Sysmon Blocked File Shredding |
test |
2023-07-20 |
| sigma |
Sysmon File Executable Creation Detected |
test |
2023-07-20 |
| sigma |
Use NTFS Short Name in Image |
test |
2023-07-20 |
| snort |
ET TROJAN Kaiten User Agent |
rev 1 |
2023-07-19 |
| snort |
ET CURRENT_EVENTS Vietnamese Govt Credential Phish M1 2023-07-18 |
rev 1 |
2023-07-18 |
| snort |
ET WEB_SPECIFIC_APPS Zimbra XSS via momoveto |
rev 1 |
2023-07-18 |
| snort |
ET CURRENT_EVENTS Vietnamese Govt Credential Phish M3 2023-07-18 |
rev 1 |
2023-07-18 |
| snort |
ET CURRENT_EVENTS Vietnamese Govt Credential Phish M2 2023-07-18 |
rev 1 |
2023-07-18 |