| suricata |
ET INFO Observed DNS Query to .foo TLD |
rev 1 |
2023-05-18 |
| suricata |
ET INFO Observed DNS Query to .phd TLD |
rev 1 |
2023-05-18 |
| suricata |
ET INFO Observed DNS Query to .dad TLD |
rev 1 |
2023-05-18 |
| suricata |
ET INFO Observed DNS Query to .prof TLD |
rev 1 |
2023-05-18 |
| suricata |
ET INFO ChatGPT-User Traffic Detected Inbound M2 |
rev 1 |
2023-05-18 |
| suricata |
ET INFO Observed DNS Query to .zip TLD |
rev 1 |
2023-05-18 |
| suricata |
ET INFO Observed DNS Query to .nexus TLD |
rev 1 |
2023-05-18 |
| suricata |
ET INFO Observed DNS Query to .esq TLD |
rev 1 |
2023-05-18 |
| sigma |
Download From Suspicious TLD - Whitelist |
test |
2023-05-18 |
| sigma |
Download From Suspicious TLD - Blacklist |
test |
2023-05-18 |
| sigma |
Download from Suspicious Dyndns Hosts |
test |
2023-05-18 |
| sigma |
Telegram API Access |
test |
2023-05-18 |
| sigma |
Certificate Exported Via PowerShell |
test |
2023-05-18 |
| sigma |
Certificate Exported Via PowerShell - ScriptBlock |
test |
2023-05-18 |
| sigma |
Potential WWlib.DLL Sideloading |
test |
2023-05-18 |
| sigma |
Potential WerFault ReflectDebugger Registry Value Abuse |
test |
2023-05-18 |
| sigma |
Potentially Suspicious File Download From ZIP TLD |
test |
2023-05-18 |
| sigma |
Potential Password Reconnaissance Via Findstr.EXE |
test |
2023-05-18 |
| sigma |
Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy |
test |
2023-05-18 |
| sigma |
SNAKE Malware WerFault Persistence File Creation |
test |
2023-05-18 |
| sigma |
APT40 Dropbox Tool User Agent |
test |
2023-05-18 |
| snort |
ET TROJAN Win32/Packed.BlackMoon.A Variant Checkin |
rev 1 |
2023-05-17 |
| snort |
ET POLICY Ryeol HTTP Client Class |
rev 4 |
2023-05-17 |
| suricata |
ET INFO Ryeol HTTP Client Class |
rev 7 |
2023-05-17 |
| sigma |
Suspicious Advpack Call Via Rundll32.EXE |
test |
2023-05-17 |
| sigma |
Potentially Suspicious Rundll32 Activity |
test |
2023-05-17 |
| sigma |
AWS IAM S3Browser Templated S3 Bucket Policy Creation |
test |
2023-05-17 |
| sigma |
AWS IAM S3Browser LoginProfile Creation |
test |
2023-05-17 |
| sigma |
AWS IAM S3Browser User or AccessKey Creation |
test |
2023-05-17 |
| snort |
ET POLICY Recuva File Recovery Software - Observed User-Agent |
rev 7 |
2023-05-16 |
| snort |
ET POLICY Cnet App Download and Checkin |
rev 7 |
2023-05-16 |
| suricata |
ET INFO Recuva File Recovery Software - Observed User-Agent |
rev 12 |
2023-05-16 |
| suricata |
ET INFO Cnet App Download and Checkin |
rev 7 |
2023-05-16 |
| sigma |
Suspicious RDP Redirect Using TSCON |
test |
2023-05-16 |
| sigma |
LiveKD Driver Creation |
test |
2023-05-16 |
| sigma |
LiveKD Kernel Memory Dump File Created |
test |
2023-05-16 |
| sigma |
LiveKD Driver Creation By Uncommon Process |
test |
2023-05-16 |
| snort |
ET ATTACK_RESPONSE Amadey CnC Panel Inbound |
rev 1 |
2023-05-15 |
| snort |
ET POLICY HTMLGET User Agent Detected - Often Linux utility based |
rev 5 |
2023-05-15 |
| snort |
ET TROJAN Win32/Pift DNS TXT CnC Lookup ppidn.net |
rev 6 |
2023-05-15 |