| snort |
ET TROJAN Win32/Spy.Banker.ZZN Variant Checkin |
rev 1 |
2023-04-26 |
| suricata |
ET PHISHING Successful Generic Credential Phish from W3LL STORE Phishkit 2023-04-25 |
rev 1 |
2023-04-26 |
| suricata |
ET MALWARE Win32/Spy.Banker.ZZN Variant Checkin |
rev 1 |
2023-04-26 |
| suricata |
ET PHISHING W3LL STORE Credential Phish Landing Page 2023-04-25 |
rev 1 |
2023-04-26 |
| sigma |
Potential Access Token Abuse |
test |
2023-04-26 |
| sigma |
A Security-Enabled Global Group Was Deleted |
stable |
2023-04-26 |
| sigma |
A Member Was Added to a Security-Enabled Global Group |
stable |
2023-04-26 |
| sigma |
A Member Was Removed From a Security-Enabled Global Group |
stable |
2023-04-26 |
| snort |
ET INFO PowerShell Hidden Window Command Common In Powershell Stagers M1 |
rev 5 |
2023-04-25 |
| snort |
ET INFO PowerShell DownloadString Command Common In Powershell Stagers |
rev 6 |
2023-04-25 |
| snort |
ET INFO PowerShell Hidden Window Command Common In Powershell Stagers M2 |
rev 5 |
2023-04-25 |
| snort |
ET INFO RDP - Response To External Host |
rev 10 |
2023-04-25 |
| snort |
ET INFO PowerShell DownloadFile Command Common In Powershell Stagers |
rev 5 |
2023-04-25 |
| snort |
ET INFO PowerShell DownloadData Command Common In Powershell Stagers |
rev 5 |
2023-04-25 |
| snort |
ET INFO PowerShell NonInteractive Command Common In Powershell Stagers |
rev 5 |
2023-04-25 |
| snort |
ET TROJAN ZStealer Admin Panel Inbound |
rev 1 |
2023-04-25 |
| snort |
ET ATTACK_RESPONSE PowerShell NoProfile Command Received In Powershell Stagers |
rev 6 |
2023-04-25 |
| suricata |
ET HUNTING PowerShell Hidden Window Command Common In Powershell Stagers M1 |
rev 4 |
2023-04-25 |
| suricata |
ET HUNTING PowerShell Hidden Window Command Common In Powershell Stagers M2 |
rev 4 |
2023-04-25 |
| suricata |
ET HUNTING PowerShell DownloadString Command Common In Powershell Stagers |
rev 5 |
2023-04-25 |
| suricata |
ET MALWARE ZStealer Admin Panel Inbound |
rev 1 |
2023-04-25 |
| suricata |
ET HUNTING PowerShell DownloadFile Command Common In Powershell Stagers |
rev 4 |
2023-04-25 |
| suricata |
ET HUNTING PowerShell DownloadData Command Common In Powershell Stagers |
rev 4 |
2023-04-25 |
| suricata |
ET HUNTING PowerShell NonInteractive Command Common In Powershell Stagers |
rev 4 |
2023-04-25 |
| suricata |
ET INFO RDP - Response To External Host |
rev 10 |
2023-04-25 |
| suricata |
ET ATTACK_RESPONSE PowerShell NoProfile Command Received In Powershell Stagers |
rev 5 |
2023-04-25 |
| sigma |
PaperCut MF/NG Potential Exploitation |
test |
2023-04-25 |
| sigma |
HackTool - Certify Execution |
test |
2023-04-25 |
| sigma |
PaperCut MF/NG Exploitation Related Indicators |
test |
2023-04-25 |
| snort |
ET CURRENT_EVENTS Successful DHL Credential Phish 2023-04-24 |
rev 1 |
2023-04-24 |
| snort |
ET INFO JAR Sent Claiming To Be Image - Likely Exploit Kit |
rev 2 |
2023-04-24 |
| snort |
ET INFO imPcRemote Download |
rev 2 |
2023-04-24 |
| snort |
ET TROJAN Roopy File Grabber Exfiltration Attempt |
rev 1 |
2023-04-24 |
| snort |
ET USER_AGENTS Win32/FakeAV InternetSecurityGuard User-Agent |
rev 1 |
2023-04-24 |
| snort |
ET INFO JAR Sent Claiming To Be Text Content - Likely Exploit Kit |
rev 2 |
2023-04-24 |
| snort |
ET EXPLOIT GoCD Authentication Bypass Successful Leak |
rev 1 |
2023-04-24 |
| suricata |
ET USER_AGENTS Win32/FakeAV InternetSecurityGuard User-Agent |
rev 1 |
2023-04-24 |
| suricata |
ET HUNTING JAR Sent Claiming To Be Text Content - Likely Exploit Kit |
rev 4 |
2023-04-24 |
| suricata |
ET HUNTING JAR Sent Claiming To Be Image - Likely Exploit Kit |
rev 4 |
2023-04-24 |
| suricata |
ET MALWARE Roopy File Grabber Exfiltration Attempt |
rev 1 |
2023-04-24 |