| sigma |
SNAKE Malware Service Persistence |
test |
2023-05-10 |
| snort |
ET POLICY IRC Channel JOIN on non-standard port |
rev 18 |
2023-05-09 |
| snort |
ET ATTACK_RESPONSE MrRobot LYON Admin Panel Inbound |
rev 1 |
2023-05-09 |
| snort |
ET POLICY PTsecurity Remote Desktop AeroAdmin handshake |
rev 3 |
2023-05-09 |
| snort |
ET POLICY SMB2 NT Create AndX Request For an Executable File In a Temp Directory |
rev 3 |
2023-05-09 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2022-02-04 |
rev 2 |
2023-05-09 |
| snort |
ET POLICY PTsecurity Remote Desktop AeroAdmin Server Hello |
rev 2 |
2023-05-09 |
| suricata |
ET ATTACK_RESPONSE MrRobot LYON Admin Panel Inbound |
rev 1 |
2023-05-09 |
| suricata |
ET INFO IRC Channel JOIN on non-standard port |
rev 18 |
2023-05-09 |
| suricata |
ET INFO PTsecurity Remote Desktop AeroAdmin handshake |
rev 3 |
2023-05-09 |
| suricata |
ET INFO PTsecurity Remote Desktop AeroAdmin Server Hello |
rev 3 |
2023-05-09 |
| suricata |
ET INFO SMB2 NT Create AndX Request For an Executable File In a Temp Directory |
rev 3 |
2023-05-09 |
| suricata |
ET PHISHING Successful Generic Credential Phish 2022-02-04 |
rev 2 |
2023-05-09 |
| sigma |
Potential AMSI Bypass Script Using NULL Bits |
test |
2023-05-09 |
| sigma |
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses |
test |
2023-05-09 |
| sigma |
Potential SysInternals ProcDump Evasion |
test |
2023-05-09 |
| sigma |
Add Windows Capability Via PowerShell Script |
test |
2023-05-09 |
| sigma |
HackTool - Dumpert Process Dumper Default File |
test |
2023-05-09 |
| sigma |
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock |
test |
2023-05-09 |
| sigma |
Potential AMSI Bypass Using NULL Bits |
test |
2023-05-09 |
| sigma |
PowerShell Script Dropped Via PowerShell.EXE |
test |
2023-05-09 |
| sigma |
Potential RemoteFXvGPUDisablement.EXE Abuse |
test |
2023-05-09 |
| sigma |
Add Windows Capability Via PowerShell Cmdlet |
test |
2023-05-09 |
| sigma |
Rclone Config File Creation |
test |
2023-05-09 |
| sigma |
Potential Suspicious PowerShell Module File Created |
test |
2023-05-09 |
| sigma |
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module |
test |
2023-05-09 |
| sigma |
PowerShell Module File Created |
test |
2023-05-09 |
| snort |
ET POLICY Microsoft user-agent automated process response to automated request |
rev 10 |
2023-05-08 |
| snort |
ET POLICY Java EXE Download |
rev 5 |
2023-05-08 |
| snort |
ET POLICY Petite Packed Binary Download |
rev 7 |
2023-05-08 |
| suricata |
ET INFO Microsoft user-agent automated process response to automated request |
rev 9 |
2023-05-08 |
| sigma |
ProxyLogon Reset Virtual Directories Based On IIS Log |
test |
2023-05-08 |
| sigma |
Potential Homoglyph Attack Using Lookalike Characters in Filename |
test |
2023-05-08 |
| sigma |
Nginx Core Dump |
test |
2023-05-08 |
| sigma |
Potential SolidPDFCreator.DLL Sideloading |
test |
2023-05-07 |
| sigma |
Potential Homoglyph Attack Using Lookalike Characters |
test |
2023-05-07 |
| snort |
ET TROJAN W32/Snojan.BNQKZQH Payload Inbound |
rev 1 |
2023-05-05 |
| snort |
ET TROJAN Papercut MF/NG User/Group Sync FTP Backdoor trigger |
rev 1 |
2023-05-05 |
| suricata |
ET MALWARE W32/Snojan.BNQKZQH Payload Inbound |
rev 1 |
2023-05-05 |
| suricata |
ET MALWARE Papercut MF/NG User/Group Sync FTP Backdoor trigger |
rev 1 |
2023-05-05 |