| sigma |
Windows Registry Trust Record Modification |
test |
2023-06-21 |
| snort |
ET CURRENT_EVENTS Generic Survey Credential Phish Landing Page 2022-06-20 |
rev 1 |
2023-06-20 |
| suricata |
ET PHISHING Generic Survey Credential Phish Landing Page 2022-06-20 |
rev 1 |
2023-06-20 |
| sigma |
Potential appverifUI.DLL Sideloading |
test |
2023-06-20 |
| sigma |
Malicious PowerShell Keywords |
test |
2023-06-20 |
| sigma |
Potential ShellDispatch.DLL Sideloading |
test |
2023-06-20 |
| sigma |
Potential ShellDispatch.DLL Functionality Abuse |
test |
2023-06-20 |
| snort |
ET MOBILE_MALWARE Android/Spy.Bahamut.I CnC Domain in DNS Lookup |
rev 1 |
2023-06-19 |
| sigma |
Cscript/Wscript Uncommon Script Extension Execution |
test |
2023-06-19 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful Folder Request - CVE-2023-34362 Stage 4 |
rev 2 |
2023-06-16 |
| snort |
ET TROJAN Mystic Stealer Admin Panel 2023-06-16 |
rev 1 |
2023-06-16 |
| suricata |
ET MALWARE Mystic Stealer Admin Panel 2023-06-16 |
rev 1 |
2023-06-16 |
| suricata |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful Folder Request - CVE-2023-34362 Stage 4 |
rev 2 |
2023-06-16 |
| suricata |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful API Token Request - CVE-2023-34362 Stage 3 |
rev 2 |
2023-06-16 |
| sigma |
Named Pipe Created Via Mkfifo |
test |
2023-06-16 |
| sigma |
Potentially Suspicious Named Pipe Created Via Mkfifo |
test |
2023-06-16 |
| sigma |
Linux Base64 Encoded Pipe to Shell |
test |
2023-06-16 |
| sigma |
UNC4841 - SSL Certificate Exfiltration Via Openssl |
test |
2023-06-16 |
| sigma |
UNC4841 - Email Exfiltration File Pattern |
test |
2023-06-16 |
| sigma |
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget |
test |
2023-06-16 |
| sigma |
UNC4841 - Potential SEASPY Execution |
test |
2023-06-16 |
| sigma |
UNC4841 - Download Compressed Files From Temp.sh Using Wget |
test |
2023-06-16 |
| sigma |
New Virtual Smart Card Created Via TpmVscMgr.EXE |
test |
2023-06-15 |
| snort |
ET INFO DropBox User Content Download for payload.bin |
rev 1 |
2023-06-14 |
| suricata |
ET HUNTING DropBox User Content Download for payload.bin |
rev 1 |
2023-06-14 |
| sigma |
Potential CVE-2023-25157 Exploitation Attempt |
test |
2023-06-14 |
| sigma |
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script |
test |
2023-06-14 |
| sigma |
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script |
test |
2023-06-14 |
| sigma |
Gpscript Execution |
test |
2023-06-14 |
| sigma |
Potential Waveedit.DLL Sideloading |
test |
2023-06-14 |
| sigma |
CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module |
test |
2023-06-14 |
| snort |
ET EXPLOIT Fortigate VPN - Request to /remote/info - Possible CVE-2023-27997 Exploit Attempt |
rev 1 |
2023-06-13 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 1b |
rev 1 |
2023-06-13 |
| snort |
ET TROJAN Successful Win32/TrojanDownloader.VB.RUI Exfil Activity M1 |
rev 1 |
2023-06-13 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - Guest Account Creation - CVE-2023-34362 Stage 1a |
rev 1 |
2023-06-13 |
| snort |
ET TROJAN Win32/TrojanDownloader.VB.RUI Checkin |
rev 1 |
2023-06-13 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 5a |
rev 1 |
2023-06-13 |
| snort |
ET TROJAN Successful Win32/TrojanDownloader.VB.RUI Exfil Activity M2 |
rev 1 |
2023-06-13 |
| snort |
ET TROJAN Kimsuky ReconShark Payload Retrieval Request M1 |
rev 1 |
2023-06-13 |
| snort |
ET TROJAN Kimsuky ReconShark Payload Retrieval Request M2 |
rev 1 |
2023-06-13 |