| suricata |
ET MALWARE Atom Logger exfil via SMTP |
rev 5 |
2023-05-30 |
| sigma |
Potential CVE-2023-25717 Exploitation Attempt |
test |
2023-05-30 |
| sigma |
Qakbot Rundll32 Exports Execution |
test |
2023-05-30 |
| sigma |
File With Suspicious Extension Downloaded Via Bitsadmin |
test |
2023-05-30 |
| sigma |
Potentially Suspicious Regsvr32 HTTP/FTP Pattern |
test |
2023-05-26 |
| sigma |
Potentially Suspicious Child Process Of Regsvr32 |
test |
2023-05-26 |
| sigma |
Regsvr32 Execution From Potential Suspicious Location |
test |
2023-05-26 |
| sigma |
Regsvr32 Execution From Highly Suspicious Location |
test |
2023-05-26 |
| sigma |
Scripting/CommandLine Process Spawned Regsvr32 |
test |
2023-05-26 |
| sigma |
Odbcconf.EXE Suspicious DLL Location |
test |
2023-05-26 |
| sigma |
Cisco Clear Logs |
test |
2023-05-26 |
| snort |
ET INFO Explorer Shell CLSID COM Object Call Method Inbound via TCP |
rev 3 |
2023-05-25 |
| snort |
ET TROJAN WhiteSnake Stealer Telegram Checkin |
rev 1 |
2023-05-25 |
| snort |
ET TROJAN Bandit Stealer Data Exfiltration Attempt |
rev 1 |
2023-05-25 |
| snort |
ET POLICY Majestic12 User-Agent Request Outbound |
rev 3 |
2023-05-25 |
| suricata |
ET INFO Majestic12 User-Agent Request Outbound |
rev 6 |
2023-05-25 |
| suricata |
ET INFO Explorer Shell CLSID COM Object Call Method Inbound via TCP |
rev 4 |
2023-05-25 |
| suricata |
ET MALWARE Bandit Stealer Data Exfiltration Attempt |
rev 1 |
2023-05-25 |
| snort |
ET INFO Possible Successful Generic Phish to webwave .dev Domain 2023-05-24 |
rev 1 |
2023-05-24 |
| snort |
ET INFO Terse Named Filename EXE Download - Possibly Hostile |
rev 3 |
2023-05-24 |
| snort |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M2 |
rev 4 |
2023-05-24 |
| snort |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M1 |
rev 3 |
2023-05-24 |
| snort |
ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy |
rev 3 |
2023-05-24 |
| snort |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M3 |
rev 3 |
2023-05-24 |
| snort |
ET INFO Rejetto HTTP File Sever Response |
rev 1 |
2023-05-24 |
| snort |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M4 |
rev 4 |
2023-05-24 |
| suricata |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M1 |
rev 3 |
2023-05-24 |
| suricata |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M4 |
rev 4 |
2023-05-24 |
| suricata |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M3 |
rev 3 |
2023-05-24 |
| suricata |
ET HUNTING Rejetto HTTP File Sever Response |
rev 1 |
2023-05-24 |
| suricata |
ET HUNTING Terse Named Filename EXE Download - Possibly Hostile |
rev 5 |
2023-05-24 |
| suricata |
ET EXPLOIT Possible BIND9 DoS CVE-2015-5477 M2 |
rev 4 |
2023-05-24 |
| suricata |
ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy |
rev 4 |
2023-05-24 |
| sigma |
Failed DNS Zone Transfer |
test |
2023-05-24 |
| sigma |
Qakbot Rundll32 Fake DLL Extension Execution |
test |
2023-05-24 |
| sigma |
Potential Qakbot Rundll32 Execution |
test |
2023-05-24 |
| sigma |
Potentially Suspicious Regsvr32 HTTP IP Pattern |
test |
2023-05-24 |
| sigma |
Regsvr32 DLL Execution With Uncommon Extension |
test |
2023-05-24 |
| snort |
ET TROJAN Kraken Stealer SMTP Data Exfiltration Attempt |
rev 1 |
2023-05-23 |
| suricata |
ET INFO Possible IP Check curlmyip.com |
rev 6 |
2023-05-23 |