| snort |
ET EXPLOIT Fortigate VPN - Request to /remote/info - Possible CVE-2023-27997 Exploit Attempt |
rev 1 |
2023-06-13 |
| snort |
ET TROJAN Win32/TrojanDownloader.VB.RUI Checkin |
rev 1 |
2023-06-13 |
| suricata |
ET MALWARE Kimsuky ReconShark Payload Retrieval Request M1 |
rev 1 |
2023-06-13 |
| suricata |
ET ATTACK_RESPONSE FightAgent WebShell Response Outbound |
rev 1 |
2023-06-13 |
| suricata |
ET MALWARE Successful Win32/TrojanDownloader.VB.RUI Exfil Activity M1 |
rev 1 |
2023-06-13 |
| suricata |
ET MALWARE Kimsuky HTA Payload Retrieval Attempt |
rev 1 |
2023-06-13 |
| suricata |
ET MALWARE Kimsuky ReconShark Payload Retrieval Request M2 |
rev 1 |
2023-06-13 |
| suricata |
ET EXPLOIT Fortigate VPN - Request to /remote/info - Possible CVE-2023-27997 Exploit Attempt |
rev 1 |
2023-06-13 |
| suricata |
ET MALWARE Successful Win32/TrojanDownloader.VB.RUI Exfil Activity M2 |
rev 1 |
2023-06-13 |
| snort |
ET CURRENT_EVENTS Successful iCloud Credential Phish 2023-06-12 |
rev 1 |
2023-06-12 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Folder Request - CVE-2023-34362 Stage 4 |
rev 1 |
2023-06-12 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - CSRF Token Request on guestaccess.aspx - CVE-2023-34362 Stage 1b |
rev 1 |
2023-06-12 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Trigger SQL Injection via guestaccess.aspx - CVE-2023-34362 Stage 2 |
rev 1 |
2023-06-12 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Payload Trigger Request - CVE-2023-34362 Stage 5b |
rev 1 |
2023-06-12 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful CSRF Token Request on guestaccess.aspx - CVE-2023-34362 Stage 1b |
rev 1 |
2023-06-12 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - API Token Request - CVE-2023-34362 Stage 3 |
rev 1 |
2023-06-12 |
| suricata |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - CSRF Token Request on guestaccess.aspx - CVE-2023-34362 Stage 1b |
rev 1 |
2023-06-12 |
| suricata |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Trigger SQL Injection via guestaccess.aspx - CVE-2023-34362 Stage 2 |
rev 1 |
2023-06-12 |
| suricata |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - API Token Request - CVE-2023-34362 Stage 3 |
rev 1 |
2023-06-12 |
| suricata |
ET PHISHING Successful iCloud Credential Phish 2023-06-12 |
rev 1 |
2023-06-12 |
| suricata |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful CSRF Token Request on guestaccess.aspx - CVE-2023-34362 Stage 1b |
rev 1 |
2023-06-12 |
| sigma |
Creation Of a Suspicious ADS File Outside a Browser Download |
test |
2023-06-12 |
| sigma |
Potentially Suspicious Child Process Of ClickOnce Application |
test |
2023-06-12 |
| sigma |
PrinterNightmare Mimikatz Driver Name |
test |
2023-06-12 |
| snort |
ET TROJAN [ANY.RUN] Win32/DynamicRAT CnC Activity |
rev 1 |
2023-06-09 |
| snort |
ET TROJAN IIS-Raid Module Backdoor - Successful INJ Command in HTTP Response |
rev 1 |
2023-06-09 |
| snort |
ET TROJAN Win32/DarkVision RAT CnC Checkin M2 |
rev 2 |
2023-06-09 |
| snort |
ET TROJAN IIS-Raid Module Backdoor - INJ Command in HTTP Request |
rev 1 |
2023-06-09 |
| snort |
ET TROJAN Win32/DarkVision RAT CnC Checkin M3 |
rev 2 |
2023-06-09 |
| suricata |
ET MALWARE IIS-Raid Module Backdoor - INJ Command in HTTP Request |
rev 1 |
2023-06-09 |
| suricata |
ET MALWARE [ANY.RUN] Win32/DynamicRAT CnC Activity |
rev 1 |
2023-06-09 |
| suricata |
ET MALWARE IIS-Raid Module Backdoor - Successful INJ Command in HTTP Response |
rev 1 |
2023-06-09 |
| sigma |
Potential RjvPlatform.DLL Sideloading From Non-Default Location |
test |
2023-06-09 |
| sigma |
Potential Persistence Via Logon Scripts - CommandLine |
test |
2023-06-09 |
| sigma |
Potential RjvPlatform.DLL Sideloading From Default Location |
test |
2023-06-09 |
| sigma |
Potential Edputil.DLL Sideloading |
test |
2023-06-09 |
| sigma |
Uncommon Child Processes Of SndVol.exe |
test |
2023-06-09 |
| sigma |
Potential CVE-2023-2283 Exploitation |
test |
2023-06-09 |
| sigma |
Potential 7za.DLL Sideloading |
test |
2023-06-09 |
| snort |
ET TROJAN CMDEmber Backdoor Style Request |
rev 1 |
2023-06-08 |