| suricata |
ET PHISHING Vietnamese Govt Credential Phish M3 2023-07-18 |
rev 1 |
2023-07-18 |
| suricata |
ET PHISHING Vietnamese Govt Credential Phish M2 2023-07-18 |
rev 1 |
2023-07-18 |
| suricata |
ET PHISHING Vietnamese Govt Credential Phish M1 2023-07-18 |
rev 1 |
2023-07-18 |
| suricata |
ET WEB_SPECIFIC_APPS Zimbra XSS via momoveto |
rev 1 |
2023-07-18 |
| sigma |
Firewall Rule Update Via Netsh.EXE |
test |
2023-07-18 |
| sigma |
Windows Defender Definition Files Removed |
test |
2023-07-18 |
| sigma |
PowerShell Script Change Permission Via Set-Acl - PsScript |
test |
2023-07-18 |
| sigma |
Scheduled Task Executing Payload from Registry |
test |
2023-07-18 |
| sigma |
PowerShell Set-Acl On Windows Folder - PsScript |
test |
2023-07-18 |
| sigma |
Ursnif Redirection Of Discovery Commands |
test |
2023-07-16 |
| sigma |
Potentially Suspicious Call To Win32_NTEventlogFile Class |
test |
2023-07-13 |
| sigma |
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet |
test |
2023-07-13 |
| sigma |
Potential CVE-2023-36884 Exploitation - Share Access |
test |
2023-07-13 |
| sigma |
Potential CCleanerReactivator.DLL Sideloading |
test |
2023-07-13 |
| sigma |
Potential CCleanerDU.DLL Sideloading |
test |
2023-07-13 |
| sigma |
Potential CVE-2023-36884 Exploitation Dropped File |
test |
2023-07-13 |
| sigma |
Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript |
test |
2023-07-13 |
| snort |
ET TROJAN Win32/RootTeam Stealer CnC Exfil M1 |
rev 1 |
2023-07-12 |
| snort |
ET TROJAN Storm-0978 RomCom RAT CnC Checkin |
rev 1 |
2023-07-12 |
| snort |
ET TROJAN Win32/RootTeam Stealer CnC Exfil M2 |
rev 1 |
2023-07-12 |
| suricata |
ET MALWARE Win32/RootTeam Stealer CnC Exfil M2 |
rev 1 |
2023-07-12 |
| suricata |
ET MALWARE Win32/RootTeam Stealer CnC Exfil M1 |
rev 1 |
2023-07-12 |
| suricata |
ET MALWARE Storm-0978 RomCom RAT CnC Checkin |
rev 1 |
2023-07-12 |
| sigma |
Potential CVE-2023-36884 Exploitation - URL Marker |
test |
2023-07-12 |
| sigma |
Potential CVE-2023-36884 Exploitation Pattern |
test |
2023-07-12 |
| sigma |
Potential CVE-2023-36884 Exploitation - File Downloads |
test |
2023-07-12 |
| sigma |
Abusable DLL Potential Sideloading From Suspicious Location |
test |
2023-07-11 |
| snort |
ET TROJAN [ANY.RUN] Hydrochasma Fast Reverse Proxy M2 |
rev 1 |
2023-07-10 |
| suricata |
ET MALWARE [ANY.RUN] Hydrochasma Fast Reverse Proxy M2 |
rev 2 |
2023-07-10 |
| sigma |
Windows Mail App Mailbox Access Via PowerShell Script |
test |
2023-07-08 |
| sigma |
Active Directory Computers Enumeration With Get-AdComputer |
test |
2023-07-08 |
| snort |
ET CURRENT_EVENTS Successful SFR Mail Credential Phish 2023-07-07 |
rev 1 |
2023-07-07 |
| snort |
ET TROJAN ASPXSPY - Manic Menagerie Variant Activity M1 |
rev 1 |
2023-07-07 |
| suricata |
ET PHISHING Successful SFR Mail Credential Phish 2023-07-07 |
rev 1 |
2023-07-07 |
| suricata |
ET WEB_SERVER ASPXSPY - Manic Menagerie Variant Activity M1 |
rev 1 |
2023-07-07 |
| snort |
ET TROJAN ASPXSPY Webshell Login Attempt |
rev 1 |
2023-07-06 |
| snort |
ET INFO Abnormal User-Agent No space after colon - Likely Hostile |
rev 13 |
2023-07-06 |
| snort |
ET GAMES FreeRide Games |
rev 7 |
2023-07-06 |
| suricata |
ET WEB_SERVER ASPXSPY Webshell Login Attempt |
rev 1 |
2023-07-06 |
| snort |
ET INFO DYNAMIC_DNS Query to local .gd Domain |
rev 1 |
2023-07-05 |