| snort |
ET TROJAN [DCSO] Andariel Exfil Activity |
rev 1 |
2023-06-05 |
| snort |
ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text SELECT |
rev 6 |
2023-06-05 |
| snort |
ET TROJAN [DCSO] Andariel CnC Activity, Check String |
rev 1 |
2023-06-05 |
| snort |
ET TROJAN [DCSO] Possible Andariel Exfil Activity |
rev 1 |
2023-06-05 |
| snort |
ET INFO HTTP Request to a *.zip Domain |
rev 3 |
2023-06-05 |
| suricata |
ET INFO HTTP Request to a *.zip Domain |
rev 3 |
2023-06-05 |
| suricata |
ET MALWARE [DCSO] Possible Andariel Exfil Activity |
rev 1 |
2023-06-05 |
| suricata |
ET WEB_SPECIFIC_APPS Joomla! SQL Injection Attempt -- categories.php text SELECT |
rev 9 |
2023-06-05 |
| suricata |
ET MALWARE [DCSO] Andariel CnC Activity, Check String |
rev 1 |
2023-06-05 |
| sigma |
Potential Persistence Via GlobalFlags |
test |
2023-06-05 |
| sigma |
Security Service Disabled Via Reg.EXE |
test |
2023-06-05 |
| snort |
ET TROJAN APT 41 LOWKEY Backdoor - Initalisation Bytes Received from CnC |
rev 2 |
2023-06-02 |
| snort |
ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -1 Data Exfil Request - Observed in MOVEit File Transfer - INBOUND |
rev 1 |
2023-06-02 |
| snort |
ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step1 -2 Health Check User Delete Request - Observed in MOVEit File Transfer - INBOUND |
rev 1 |
2023-06-02 |
| snort |
ET WEB_SERVER LEMURLOOT WebShell Interaction Header - X-siLock-Step2/3 File Retrieval Request- Observed in MOVEit File Transfer - INBOUND |
rev 1 |
2023-06-02 |
| sigma |
Crontab Enumeration |
test |
2023-06-02 |
| sigma |
Download File To Potentially Suspicious Directory Via Wget |
test |
2023-06-02 |
| sigma |
Execution Of Script Located In Potentially Suspicious Directory |
test |
2023-06-02 |
| sigma |
Shell Execution Of Process Located In Tmp Directory |
test |
2023-06-02 |
| sigma |
Suspicious Nohup Execution |
test |
2023-06-02 |
| sigma |
OS Architecture Discovery Via Grep |
test |
2023-06-02 |
| sigma |
Potential GobRAT File Discovery Via Grep |
test |
2023-06-02 |
| sigma |
Wget Creating Files in Tmp Directory |
test |
2023-06-02 |
| sigma |
Potentially Suspicious Shell Script Creation in Profile Folder |
test |
2023-06-02 |
| sigma |
PowerShell Core DLL Loaded Via Office Application |
test |
2023-06-01 |
| sigma |
Potential Operation Triangulation C2 Beaconing Activity - Proxy |
test |
2023-06-01 |
| sigma |
Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE |
test |
2023-06-01 |
| sigma |
Potential Operation Triangulation C2 Beaconing Activity - DNS |
test |
2023-06-01 |
| sigma |
Potential SmadHook.DLL Sideloading |
test |
2023-06-01 |
| snort |
ET INFO Microsoft net.tcp Connection Initialization Activity |
rev 6 |
2023-05-31 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mov Domain |
rev 1 |
2023-05-31 |
| suricata |
ET INFO Microsoft net.tcp Connection Initialization Activity |
rev 6 |
2023-05-31 |
| sigma |
Sofacy Trojan Loader Activity |
test |
2023-05-31 |
| sigma |
Potential PowerShell Obfuscation Via Reversed Commands |
test |
2023-05-31 |
| snort |
ET TROJAN Stealbit Variant Data Exfil M1 |
rev 4 |
2023-05-30 |
| snort |
ET TROJAN Atom Logger exfil via SMTP |
rev 4 |
2023-05-30 |
| snort |
ET ATTACK_RESPONSE Mana Tools-Lone Wolf Admin Panel Inbound |
rev 1 |
2023-05-30 |
| snort |
ET TROJAN Stealbit Variant Data Exfil M2 |
rev 4 |
2023-05-30 |
| snort |
ET EXPLOIT F5 BIG-IP rsync cmi authorized_keys successful exfiltration |
rev 3 |
2023-05-30 |
| suricata |
ET MALWARE Atom Logger exfil via SMTP |
rev 5 |
2023-05-30 |