| suricata |
ET PHISHING Generic Credential Phish Landing Page from Text Scam M2 2023-05-01 |
rev 1 |
2023-05-01 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page from Text Scam M3 2023-05-01 |
rev 1 |
2023-05-01 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page from Text Scam M1 2023-05-01 |
rev 1 |
2023-05-01 |
| suricata |
ET MALWARE CMDASP Webshell Command Request |
rev 1 |
2023-05-01 |
| suricata |
ET INFO HTTP POST contains pasa form |
rev 4 |
2023-05-01 |
| sigma |
Mailbox Export to Exchange Webserver |
test |
2023-04-30 |
| sigma |
Credentials In Files - Linux |
test |
2023-04-30 |
| sigma |
Mstsc.EXE Execution With Local RDP File |
test |
2023-04-30 |
| sigma |
Potential COLDSTEEL RAT File Indicators |
test |
2023-04-30 |
| sigma |
Potential COLDSTEEL Persistence Service DLL Creation |
test |
2023-04-30 |
| sigma |
COLDSTEEL RAT Anonymous User Process Execution |
test |
2023-04-30 |
| sigma |
COLDSTEEL RAT Cleanup Command Execution |
test |
2023-04-30 |
| sigma |
COLDSTEEL RAT Service Persistence Execution |
test |
2023-04-30 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-04-28 |
rev 1 |
2023-04-28 |
| snort |
ET CURRENT_EVENTS USPS Credential Phish Landing Page M2 2023-04-28 |
rev 1 |
2023-04-28 |
| snort |
ET INFO DYNAMIC_DNS Query to *.myddns.me Domain |
rev 4 |
2023-04-28 |
| snort |
ET INFO Observed DNS Query to .myq-see .com DDNS Domain |
rev 4 |
2023-04-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.myddns.me Domain |
rev 3 |
2023-04-28 |
| snort |
ET INFO Request to Hidden Environment File - Inbound |
rev 4 |
2023-04-28 |
| snort |
ET TROJAN MageCart Skimmer Header Observed Outbound |
rev 1 |
2023-04-28 |
| snort |
ET INFO HTTP Request to logo .clearbit .com |
rev 3 |
2023-04-28 |
| snort |
ET INFO GG Url Shortener Observed in DNS Query |
rev 3 |
2023-04-28 |
| snort |
ET INFO Possible Rogue LoJack Asset Tracking Agent |
rev 4 |
2023-04-28 |
| snort |
ET INFO DYNAMIC_DNS Query to *.autoddns .com Domain |
rev 4 |
2023-04-28 |
| snort |
ET INFO Pulse Secure VPN Version Disclosure Attempt |
rev 3 |
2023-04-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.autoddns.com Domain |
rev 3 |
2023-04-28 |
| suricata |
ET INFO Request to Hidden Environment File - Inbound |
rev 3 |
2023-04-28 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-04-28 |
rev 1 |
2023-04-28 |
| suricata |
ET INFO Pulse Secure VPN Version Disclosure Attempt |
rev 3 |
2023-04-28 |
| suricata |
ET PHISHING USPS Credential Phish Landing Page M2 2023-04-28 |
rev 1 |
2023-04-28 |
| snort |
ET TROJAN TitanStealer Data Exfiltration Attempt |
rev 1 |
2023-04-27 |
| snort |
ET TROJAN Win32/Spy.Mekotio.ER Checkin |
rev 2 |
2023-04-27 |
| snort |
ET TROJAN Suspected Win32/HMR RAT/LOBSHOT Initial Handshake |
rev 1 |
2023-04-27 |
| suricata |
ET MALWARE Win32/Spy.Mekotio.ER Checkin |
rev 2 |
2023-04-27 |
| suricata |
ET MALWARE Suspected Win32/HMR RAT/LOBSHOT Initial Handshake |
rev 1 |
2023-04-27 |
| sigma |
SonicWall SSL/VPN Jarrewrite Exploitation |
test |
2023-04-27 |
| sigma |
HackTool - Rubeus Execution - ScriptBlock |
test |
2023-04-27 |
| snort |
ET CURRENT_EVENTS W3LL STORE Credential Phish Landing Page 2023-04-25 |
rev 1 |
2023-04-26 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish from W3LL STORE Phishkit 2023-04-25 |
rev 1 |
2023-04-26 |
| snort |
ET INFO Bitcoin QR Code Generated via Btcfrog.com |
rev 2 |
2023-04-26 |