| snort |
ET TROJAN Win32/Ramgex.D Checkin |
rev 1 |
2023-07-05 |
| snort |
ET INFO DYNAMIC_DNS Query to local .gd Domain |
rev 1 |
2023-07-05 |
| suricata |
ET MALWARE Win32/Ramgex.D Checkin |
rev 1 |
2023-07-05 |
| elastic |
Reverse Shell Created via Named Pipe |
deprecated |
2023-07-04 |
| snort |
ET INFO IDrive Backup Connection |
rev 1 |
2023-07-03 |
| snort |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M1 |
rev 1 |
2023-07-03 |
| snort |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M2 |
rev 1 |
2023-07-03 |
| snort |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M3 |
rev 1 |
2023-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M1 |
rev 1 |
2023-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M3 |
rev 1 |
2023-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M2 |
rev 1 |
2023-07-03 |
| elastic |
Deprecated - Threat Intel Indicator Match |
deprecated |
2023-07-03 |
| elastic |
Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match |
deprecated |
2023-07-03 |
| sigma |
Potential Registry Reconnaissance Via PowerShell Script |
test |
2023-07-02 |
| snort |
ET TROJAN Win32/Duino-Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| snort |
ET TROJAN Win32/Sinresby.B Checkin |
rev 1 |
2023-06-30 |
| snort |
ET CURRENT_EVENTS Successful Yahoo Credential Phish 2023-06-30 |
rev 1 |
2023-06-30 |
| snort |
ET TROJAN Win32/Repl_it Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| suricata |
ET MALWARE Win32/Sinresby.B Checkin |
rev 1 |
2023-06-30 |
| suricata |
ET COINMINER Win32/Duino-Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| suricata |
ET COINMINER Win32/Repl_it Coin Miner CnC Checkin |
rev 1 |
2023-06-30 |
| sigma |
Insecure Transfer Via Curl.EXE |
test |
2023-06-30 |
| sigma |
Potential ReflectDebugger Content Execution Via WerFault.EXE |
test |
2023-06-30 |
| snort |
ET TROJAN ThirdEye Stealer System Information Gathering Attempt |
rev 1 |
2023-06-29 |
| snort |
ET TROJAN [ANY.RUN] Meduza Stealer Exfiltration M1 |
rev 1 |
2023-06-29 |
| snort |
ET INFO DERO Crypto Mining Related Domain in DNS Lookup |
rev 1 |
2023-06-29 |
| snort |
ET TROJAN ThirdEye Stealer CnC Checkin |
rev 1 |
2023-06-29 |
| suricata |
ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M1 |
rev 1 |
2023-06-29 |
| suricata |
ET MALWARE ThirdEye Stealer CnC Checkin |
rev 1 |
2023-06-29 |
| suricata |
ET INFO DERO Crypto Mining Related Domain in DNS Lookup |
rev 1 |
2023-06-29 |
| suricata |
ET MALWARE ThirdEye Stealer System Information Gathering Attempt |
rev 1 |
2023-06-29 |
| snort |
ET TROJAN Mystic Stealer C2 Client Hello Packet |
rev 2 |
2023-06-28 |
| snort |
ET TROJAN [ANY.RUN] StatusRecorder Stealer Sending System Information |
rev 1 |
2023-06-27 |
| suricata |
ET MALWARE [ANY.RUN] StatusRecorder Stealer Sending System Information |
rev 1 |
2023-06-27 |
| snort |
ET TROJAN [ANY.RUN] Possible Gh0stRat Checkin |
rev 1 |
2023-06-26 |
| snort |
ET TROJAN [ANY.RUN] Gh0stBins RDP Remote Connection |
rev 1 |
2023-06-26 |
| snort |
ET INFO Monero Mining Pool DNS Lookup |
rev 3 |
2023-06-26 |
| snort |
ET TROJAN [ANY.RUN] Gh0stBins Kernel Download Request |
rev 1 |
2023-06-26 |
| snort |
ET TROJAN [ANY.RUN] Gh0stBins Checkin |
rev 1 |
2023-06-26 |
| snort |
ET INFO DNS request for Monero mining pool |
rev 3 |
2023-06-26 |