| suricata |
ET INFO Generic - *.com.exe HTTP Attachment |
rev 6 |
2023-04-20 |
| suricata |
ET MALWARE Win32/Injector.DYZG Variant Checkin |
rev 1 |
2023-04-20 |
| sigma |
HackTool - Rubeus Execution |
stable |
2023-04-20 |
| snort |
ET TROJAN Win32/ScarCruf Payload Inbound |
rev 2 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Obfuscated Eval String 2 |
rev 2 |
2023-04-19 |
| snort |
ET TROJAN JS/Comm100 Trojan CnC Payload Inbound |
rev 3 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Obfuscated Eval String 6 |
rev 2 |
2023-04-19 |
| snort |
ET TROJAN JS/Comm100 Trojan Backdoor Inbound |
rev 3 |
2023-04-19 |
| snort |
ET INFO maas.io Image Download Flowbit Set |
rev 2 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Obfuscated Eval String 1 |
rev 2 |
2023-04-19 |
| snort |
ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M1 |
rev 2 |
2023-04-19 |
| snort |
ET MOBILE_MALWARE Android/Harly.AO CnC Domain in DNS Lookup |
rev 1 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Nemesis Admin Panel Inbound |
rev 1 |
2023-04-19 |
| snort |
ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M2 |
rev 2 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Obfuscated Eval String 5 |
rev 2 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Obfuscated Eval String 3 |
rev 2 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Obfuscated Eval String 7 |
rev 2 |
2023-04-19 |
| snort |
ET WEB_SERVER Common JSP WebShell String Observed in HTTP Header M3 |
rev 2 |
2023-04-19 |
| snort |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.GoatRat CnC Domain in DNS Lookup |
rev 1 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Possibly Malicious VBS Writing to Persistence Registry Location |
rev 3 |
2023-04-19 |
| snort |
ET ATTACK_RESPONSE Obfuscated Eval String 4 |
rev 2 |
2023-04-19 |
| suricata |
ET INFO maas.io Image Download Flowbit Set |
rev 4 |
2023-04-19 |
| suricata |
ET MALWARE JS/Comm100 Trojan Backdoor Inbound |
rev 2 |
2023-04-19 |
| suricata |
ET ATTACK_RESPONSE Nemesis Admin Panel Inbound |
rev 1 |
2023-04-19 |
| suricata |
ET MALWARE Win32/ScarCruf Payload Inbound |
rev 2 |
2023-04-19 |
| snort |
ET CURRENT_EVENTS Successful OneDrive Credential Phish 2023-04-18 |
rev 1 |
2023-04-18 |
| snort |
ET INFO Suspicious Windows NT version 7 User-Agent |
rev 2 |
2023-04-18 |
| snort |
ET INFO Suspicious Windows NT version 1 User-Agent |
rev 5 |
2023-04-18 |
| snort |
ET INFO Suspicious Windows NT version 8 User-Agent |
rev 3 |
2023-04-18 |
| snort |
ET INFO Suspicious Windows NT version 9 User-Agent |
rev 2 |
2023-04-18 |
| snort |
ET ATTACK_RESPONSE Nemesis Admin Panel Inbound |
rev 1 |
2023-04-18 |
| snort |
ET INFO Suspicious Windows NT version 3 User-Agent |
rev 2 |
2023-04-18 |
| snort |
ET INFO Suspicious Windows NT version 2 User-Agent |
rev 2 |
2023-04-18 |
| snort |
ET INFO Suspicious MSIE 10 on Windows NT 5 |
rev 5 |
2023-04-18 |
| suricata |
ET ATTACK_RESPONSE Nemesis Admin Panel Inbound |
rev 1 |
2023-04-18 |
| suricata |
ET HUNTING Suspicious Windows NT version 9 User-Agent |
rev 6 |
2023-04-18 |
| suricata |
ET PHISHING Successful OneDrive Credential Phish 2023-04-18 |
rev 1 |
2023-04-18 |
| suricata |
ET HUNTING Suspicious MSIE 10 on Windows NT 5 |
rev 8 |
2023-04-18 |
| suricata |
ET HUNTING Suspicious Windows NT version 7 User-Agent |
rev 6 |
2023-04-18 |
| sigma |
Potential Suspicious Winget Package Installation |
test |
2023-04-18 |