| suricata |
ET MALWARE Kraken Stealer SMTP Data Exfiltration Attempt |
rev 1 |
2023-05-23 |
| sigma |
Suspicious Driver/DLL Installation Via Odbcconf.EXE |
test |
2023-05-23 |
| sigma |
Windows Shell/Scripting Processes Spawning Suspicious Programs |
test |
2023-05-23 |
| sigma |
BlueSky Ransomware Artefacts |
test |
2023-05-23 |
| snort |
ET INFO Installshield One Click Install User-Agent Toys File |
rev 4 |
2023-05-22 |
| snort |
ET TROJAN Suspected Gamaredon Related Maldoc Activity M1 |
rev 1 |
2023-05-22 |
| snort |
ET INFO HTTP Request to Lockbit Ransomware Payment Domain |
rev 4 |
2023-05-22 |
| suricata |
ET INFO Observed IP Tracker Domain in TLS SNI |
rev 1 |
2023-05-22 |
| suricata |
ET INFO HTTP Request to Lockbit Ransomware Payment Domain |
rev 3 |
2023-05-22 |
| suricata |
ET INFO Installshield One Click Install User-Agent Toys File |
rev 5 |
2023-05-22 |
| sigma |
Potentially Suspicious GoogleUpdate Child Process |
test |
2023-05-22 |
| sigma |
Potentially Suspicious DLL Registered Via Odbcconf.EXE |
test |
2023-05-22 |
| sigma |
Uncommon Child Process Spawned By Odbcconf.EXE |
test |
2023-05-22 |
| sigma |
New DLL Registered Via Odbcconf.EXE |
test |
2023-05-22 |
| sigma |
Driver/DLL Installation Via Odbcconf.EXE |
test |
2023-05-22 |
| snort |
ET TROJAN Suspected Gamaredon Related Maldoc Activity M2 |
rev 1 |
2023-05-20 |
| snort |
ET INFO Observed DNS Query to .mov TLD |
rev 1 |
2023-05-20 |
| suricata |
ET INFO Observed DNS Query to .mov TLD |
rev 1 |
2023-05-20 |
| snort |
ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst |
rev 2 |
2023-05-19 |
| snort |
ET TROJAN Win32/Nivdort Checkin |
rev 5 |
2023-05-19 |
| snort |
ET TROJAN DeltaStealer CnC Checkin |
rev 1 |
2023-05-19 |
| snort |
ET TROJAN Win32/Trickbot Data Exfiltration M4 |
rev 2 |
2023-05-19 |
| snort |
ET TROJAN Trickbot Checkin Response |
rev 4 |
2023-05-19 |
| snort |
ET TROJAN DeltaStealer Exfiltrating Data to gofile .io |
rev 1 |
2023-05-19 |
| suricata |
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst |
rev 2 |
2023-05-19 |
| sigma |
Small Sieve Malware Potential C2 Communication |
test |
2023-05-19 |
| sigma |
Small Sieve Malware CommandLine Indicator |
test |
2023-05-19 |
| sigma |
Small Sieve Malware File Indicator Creation |
test |
2023-05-19 |
| sigma |
Suspicious Non-Browser Network Communication With Telegram API |
test |
2023-05-19 |
| sigma |
Password Policy Enumerated |
test |
2023-05-19 |
| snort |
ET INFO Observed DNS Query to .foo TLD |
rev 1 |
2023-05-18 |
| snort |
ET INFO Observed DNS Query to .phd TLD |
rev 1 |
2023-05-18 |
| snort |
ET INFO Observed DNS Query to .esq TLD |
rev 1 |
2023-05-18 |
| snort |
ET INFO Observed DNS Query to .nexus TLD |
rev 1 |
2023-05-18 |
| snort |
ET INFO Observed DNS Query to .zip TLD |
rev 1 |
2023-05-18 |
| snort |
ET INFO ChatGPT-User Traffic Detected Inbound M1 |
rev 1 |
2023-05-18 |
| snort |
ET INFO Observed DNS Query to .dad TLD |
rev 1 |
2023-05-18 |
| snort |
ET INFO ChatGPT-User Traffic Detected Inbound M2 |
rev 1 |
2023-05-18 |
| snort |
ET INFO Observed DNS Query to .prof TLD |
rev 1 |
2023-05-18 |
| suricata |
ET INFO Observed DNS Query to .esq TLD |
rev 1 |
2023-05-18 |