| sigma |
Suspicious Mstsc.EXE Execution With Local RDP File |
test |
2023-04-18 |
| sigma |
Mstsc.EXE Execution From Uncommon Parent |
test |
2023-04-18 |
| sigma |
Potential Azure Browser SSO Abuse |
test |
2023-04-18 |
| snort |
ET CURRENT_EVENTS Crypto Credential Phish Landing Page 2023-04-17 |
rev 1 |
2023-04-17 |
| snort |
ET TROJAN TyphonStealer Exfil via Telegram |
rev 1 |
2023-04-17 |
| snort |
ET INFO HTTP Request with Double Cache-Control |
rev 3 |
2023-04-17 |
| snort |
ET INFO Git Service Hosted with Gittea |
rev 1 |
2023-04-17 |
| snort |
ET CURRENT_EVENTS TDS Landing Page - Observed Leading to CryptoClipper |
rev 2 |
2023-04-17 |
| snort |
ET CURRENT_EVENTS TDS checkResult Request - Observed Leading to CryptoClipper |
rev 2 |
2023-04-17 |
| snort |
ET CURRENT_EVENTS Tech Support Phone Scam Landing 2023-04-17 |
rev 1 |
2023-04-17 |
| snort |
ET TROJAN PlutoCrypt Decryption Key Exfil |
rev 1 |
2023-04-17 |
| snort |
ET CURRENT_EVENTS Successful Bank of America Credential Phish 2023-04-17 |
rev 1 |
2023-04-17 |
| snort |
ET TROJAN StormKitty Download Request With Minimal Headers |
rev 1 |
2023-04-17 |
| suricata |
ET PHISHING Crypto Credential Phish Landing Page 2023-04-17 |
rev 1 |
2023-04-17 |
| suricata |
ET MALWARE PlutoCrypt Decryption Key Exfil |
rev 1 |
2023-04-17 |
| suricata |
ET INFO Git Service Hosted with Gittea |
rev 1 |
2023-04-17 |
| suricata |
ET EXPLOIT_KIT TDS checkResult Request - Observed Leading to CryptoClipper |
rev 2 |
2023-04-17 |
| suricata |
ET MALWARE TyphonStealer Exfil via Telegram |
rev 1 |
2023-04-17 |
| suricata |
ET EXPLOIT_KIT TDS Landing Page - Observed Leading to CryptoClipper |
rev 2 |
2023-04-17 |
| suricata |
ET PHISHING Successful Bank of America Credential Phish 2023-04-17 |
rev 1 |
2023-04-17 |
| sigma |
Potential Libvlc.DLL Sideloading |
test |
2023-04-17 |
| sigma |
Install New Package Via Winget Local Manifest |
test |
2023-04-17 |
| sigma |
Add Insecure Download Source To Winget |
test |
2023-04-17 |
| sigma |
Add New Download Source To Winget |
test |
2023-04-17 |
| sigma |
PUA - Crassus Execution |
test |
2023-04-17 |
| snort |
ET TROJAN Win32/TrojanDropper.Agent.SSQ Variant Checkin |
rev 1 |
2023-04-14 |
| snort |
ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement |
rev 3 |
2023-04-14 |
| sigma |
Potential CVE-2021-42287 Exploitation Attempt |
test |
2023-04-14 |
| sigma |
Microsoft Malware Protection Engine Crash |
test |
2023-04-14 |
| sigma |
Microsoft Malware Protection Engine Crash - WER |
test |
2023-04-14 |
| sigma |
Potential CVE-2021-42278 Exploitation Attempt |
test |
2023-04-14 |
| sigma |
Local Privilege Escalation Indicator TabTip |
test |
2023-04-14 |
| sigma |
Windows Pcap Drivers |
test |
2023-04-14 |
| sigma |
Windows Service Terminated With Error |
test |
2023-04-14 |
| sigma |
Important Windows Service Terminated Unexpectedly |
test |
2023-04-14 |
| sigma |
Important Windows Service Terminated With Error |
test |
2023-04-14 |
| sigma |
Unusually Long PowerShell CommandLine |
test |
2023-04-14 |
| sigma |
Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions |
test |
2023-04-13 |
| snort |
ET POLICY PE EXE or DLL Windows file download HTTP |
rev 4 |
2023-04-12 |
| snort |
ET MALWARE PUP/SpamFighter CnC Request |
rev 1 |
2023-04-12 |