| sigma |
Moriya Rootkit File Created |
test |
2023-05-05 |
| sigma |
Suspicious File Created In PerfLogs |
test |
2023-05-05 |
| sigma |
Windows Defender Real-Time Protection Failure/Restart |
stable |
2023-05-05 |
| sigma |
NTDS Exfiltration Filename Patterns |
test |
2023-05-05 |
| sigma |
NTDS.DIT Created |
test |
2023-05-05 |
| sigma |
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE |
test |
2023-05-05 |
| sigma |
Remote Thread Created In KeePass.EXE |
test |
2023-05-05 |
| sigma |
Standard User In High Privileged Group |
test |
2023-05-05 |
| sigma |
HackTool - Potential CobaltStrike Process Injection |
test |
2023-05-05 |
| sigma |
HackTool - CACTUSTORCH Remote Thread Creation |
test |
2023-05-05 |
| sigma |
VHD Image Download Via Browser |
test |
2023-05-05 |
| sigma |
PowerShell Script With File Hostname Resolving Capabilities |
test |
2023-05-05 |
| snort |
ET CURRENT_EVENTS W3LL STORE Phish Kit Landing Page 2023-05-05 |
rev 1 |
2023-05-04 |
| snort |
ET INFO HTTP GET Request for PSSQLite.zip - Possible Infostealer Activity |
rev 1 |
2023-05-04 |
| snort |
ET WEB_CLIENT Observed Hunter Obfuscator Code M2 |
rev 1 |
2023-05-04 |
| suricata |
ET PHISHING W3LL STORE Phish Kit Landing Page 2023-05-05 |
rev 1 |
2023-05-04 |
| suricata |
ET WEB_CLIENT Observed Hunter Obfuscator Code M2 |
rev 1 |
2023-05-04 |
| suricata |
ET HUNTING HTTP GET Request for PSSQLite.zip - Possible Infostealer Activity |
rev 1 |
2023-05-04 |
| sigma |
Potential Base64 Encoded User-Agent |
test |
2023-05-04 |
| sigma |
Suspicious Base64 Encoded User-Agent |
test |
2023-05-04 |
| sigma |
Potential SNAKE Malware Installation CLI Arguments Indicator |
test |
2023-05-04 |
| sigma |
Potential SNAKE Malware Installation Binary Indicator |
test |
2023-05-04 |
| sigma |
Potential SNAKE Malware Persistence Service Execution |
test |
2023-05-04 |
| sigma |
Suspicious Child Process Of SQL Server |
test |
2023-05-04 |
| sigma |
Potential Persistence Via PowerShell User Profile Using Add-Content |
test |
2023-05-04 |
| sigma |
Potential APT FIN7 POWERHOLD Execution |
test |
2023-05-04 |
| sigma |
Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity |
test |
2023-05-04 |
| sigma |
Veeam Backup Servers Credential Dumping Script Execution |
test |
2023-05-04 |
| sigma |
Suspicious Child Process Of Veeam Dabatase |
test |
2023-05-04 |
| sigma |
Potential Conti Ransomware Database Dumping Activity Via SQLCmd |
test |
2023-05-04 |
| sigma |
Veeam Backup Database Suspicious Query |
test |
2023-05-04 |
| sigma |
Potential POWERTRASH Script Execution |
test |
2023-05-04 |
| snort |
ET INFO Metasploit Framework Checking For Update |
rev 2 |
2023-05-03 |
| snort |
ET TROJAN Win32/BlackSun.B Retrieving Payload |
rev 1 |
2023-05-03 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2022-06-21 |
rev 2 |
2023-05-03 |
| suricata |
ET MALWARE Win32/BlackSun.B Retrieving Payload |
rev 1 |
2023-05-03 |
| sigma |
Binary Padding - Linux |
test |
2023-05-03 |
| sigma |
Potentially Suspicious Network Connection To Notion API |
test |
2023-05-03 |
| snort |
ET INFO [eSentire] Possible Kali Linux Updates |
rev 5 |
2023-05-02 |
| snort |
ET INFO Office User-Agent Requesting Non-Standard Filename |
rev 1 |
2023-05-02 |