| snort |
ET POLICY HTMLGET User Agent Detected - Often Linux utility based |
rev 5 |
2023-05-15 |
| snort |
ET CURRENT_EVENTS Greatness Phish Kit Landing Page M1 2023-05-15 |
rev 1 |
2023-05-15 |
| suricata |
ET ATTACK_RESPONSE Amadey CnC Panel Inbound |
rev 1 |
2023-05-15 |
| suricata |
ET PHISHING Greatness Phish Kit Landing Page M1 2023-05-15 |
rev 1 |
2023-05-15 |
| suricata |
ET INFO HTMLGET User Agent Detected - Often Linux utility based |
rev 7 |
2023-05-15 |
| suricata |
ET INFO GridinSoft.com Software Version Check |
rev 7 |
2023-05-15 |
| suricata |
ET MALWARE Win32/Pift DNS TXT CnC Lookup ppidn.net |
rev 6 |
2023-05-15 |
| sigma |
Wscript Shell Run In CommandLine |
test |
2023-05-15 |
| sigma |
Potential Memory Dumping Activity Via LiveKD |
test |
2023-05-15 |
| sigma |
Dllhost.EXE Execution Anomaly |
test |
2023-05-15 |
| sigma |
Potential Chrome Frame Helper DLL Sideloading |
test |
2023-05-15 |
| sigma |
Goofy Guineapig Backdoor Service Creation |
test |
2023-05-15 |
| sigma |
Potential Goofy Guineapig GoolgeUpdate Process Anomaly |
test |
2023-05-15 |
| sigma |
Potential Devil Bait Related Indicator |
test |
2023-05-15 |
| sigma |
Potential APT Mustang Panda Activity Against Australian Gov |
test |
2023-05-15 |
| sigma |
Potential Goofy Guineapig Backdoor Activity |
test |
2023-05-14 |
| sigma |
Goofy Guineapig Backdoor IOC |
test |
2023-05-14 |
| sigma |
Goofy Guineapig Backdoor Potential C2 Communication |
test |
2023-05-14 |
| sigma |
Potential RoboForm.DLL Sideloading |
test |
2023-05-14 |
| sigma |
Certificate Private Key Acquired |
test |
2023-05-13 |
| sigma |
Certificate Exported From Local Certificate Store |
test |
2023-05-13 |
| sigma |
Microsoft Excel Add-In Loaded From Uncommon Location |
test |
2023-05-12 |
| sigma |
Potential Persistence Via Custom Protocol Handler |
test |
2023-05-12 |
| sigma |
Potential Wazuh Security Platform DLL Sideloading |
test |
2023-05-12 |
| sigma |
Microsoft Excel Add-In Loaded |
test |
2023-05-12 |
| snort |
ET TROJAN BPFDoor V2 TCP Magic Packet Inbound |
rev 1 |
2023-05-11 |
| snort |
ET TROJAN BPFDoor V2 SCTP Magic Packet Inbound |
rev 1 |
2023-05-11 |
| snort |
ET TROJAN BPFDoor V2 UDP Magic Packet Inbound |
rev 1 |
2023-05-11 |
| suricata |
ET MALWARE BPFDoor V2 UDP Magic Packet Inbound |
rev 1 |
2023-05-11 |
| suricata |
ET MALWARE BPFDoor V2 SCTP Magic Packet Inbound |
rev 1 |
2023-05-11 |
| suricata |
ET MALWARE BPFDoor V2 TCP Magic Packet Inbound |
rev 1 |
2023-05-11 |
| sigma |
WinSxS Executable File Creation By Non-System Process |
test |
2023-05-11 |
| sigma |
SNAKE Malware Covert Store Registry Key |
test |
2023-05-11 |
| snort |
ET MALWARE MacOS/OnlineAppNotice Activity |
rev 1 |
2023-05-10 |
| snort |
ET CURRENT_EVENTS Successful W3LL STORE Credential Phish 2023-05-10 |
rev 1 |
2023-05-10 |
| snort |
ET INFO Possible Snake Header in HTTP Request |
rev 1 |
2023-05-10 |
| suricata |
ET PHISHING Successful W3LL STORE Credential Phish 2023-05-10 |
rev 1 |
2023-05-10 |
| suricata |
ET ADWARE_PUP MacOS/OnlineAppNotice Activity |
rev 1 |
2023-05-10 |
| sigma |
SNAKE Malware Service Persistence |
test |
2023-05-10 |
| sigma |
SNAKE Malware Installer Name Indicators |
test |
2023-05-10 |