| sigma |
HTML Help HH.EXE Suspicious Child Process |
test |
2023-04-12 |
| sigma |
Suspicious HH.EXE Execution |
test |
2023-04-12 |
| sigma |
Potential CVE-2023-21554 QueueJumper Exploitation |
test |
2023-04-12 |
| sigma |
Arbitrary Command Execution Using WSL |
test |
2023-04-12 |
| sigma |
DumpMinitool Execution |
test |
2023-04-12 |
| sigma |
Suspicious DumpMinitool Execution |
test |
2023-04-12 |
| snort |
ET TROJAN KWN Clipper Checkin via Telegram |
rev 1 |
2023-04-11 |
| suricata |
ET MALWARE KWN Clipper Checkin via Telegram |
rev 1 |
2023-04-11 |
| sigma |
Visual Studio NodejsTools PressAnyKey Renamed Execution |
test |
2023-04-11 |
| sigma |
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution |
test |
2023-04-11 |
| snort |
ET TROJAN DCRat Initial Checkin Server Response M6 |
rev 3 |
2023-04-07 |
| snort |
ET TROJAN Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam |
rev 3 |
2023-04-07 |
| snort |
ET TROJAN Win32/Phorpiex Template 7 Active - Outbound Malicious Email Spam |
rev 3 |
2023-04-07 |
| snort |
ET CURRENT_EVENTS AlaskaUSA FCU Phish 2022-07-24 |
rev 2 |
2023-04-07 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page using submit-form .com |
rev 2 |
2023-04-07 |
| snort |
ET TROJAN VectorStealer Data Exfil via Telegram |
rev 2 |
2023-04-07 |
| suricata |
ET MALWARE Win32/Phorpiex Template 8 Active - Outbound Malicious Email Spam |
rev 3 |
2023-04-07 |
| suricata |
ET MALWARE Win32/Phorpiex Template 7 Active - Outbound Malicious Email Spam |
rev 3 |
2023-04-07 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page using submit-form .com |
rev 2 |
2023-04-07 |
| sigma |
Potential Ruby Reverse Shell |
test |
2023-04-07 |
| sigma |
Bash Interactive Shell |
test |
2023-04-07 |
| sigma |
Potential PHP Reverse Shell |
test |
2023-04-07 |
| sigma |
Potential Perl Reverse Shell Execution |
test |
2023-04-07 |
| snort |
ET INFO Downloaded Powershell Script Detects AV Product |
rev 2 |
2023-04-06 |
| snort |
ET POLICY LDAPSv3 LDAPS_START_TLS Request Outbound |
rev 3 |
2023-04-06 |
| snort |
ET POLICY Successful LDAPSv3 LDAPS_START_TLS Request Outbound |
rev 3 |
2023-04-06 |
| snort |
ET INFO Suspicious Netlify Hosted GET Request - Possible Phishing Landing |
rev 3 |
2023-04-06 |
| snort |
ET POLICY Successful LDAPSv3 LDAPS_START_TLS Request Outbound |
rev 3 |
2023-04-06 |
| snort |
ET INFO Possible cs2nginx Proxy Redirect |
rev 3 |
2023-04-06 |
| snort |
ET TROJAN AppleJeus - Kupay Wallet CnC Activity |
rev 3 |
2023-04-06 |
| snort |
ET EXPLOIT WP Download From Files Plugin <= 1.48 Arbitrary File Upload Attempt |
rev 2 |
2023-04-06 |
| snort |
ET MALWARE CoinSurf Proxy CnC Response |
rev 2 |
2023-04-06 |
| snort |
ET INFO Observed DNS Query to BaitAndPhish Domain |
rev 3 |
2023-04-06 |
| suricata |
ET INFO Observed DNS Query to BaitAndPhish Domain |
rev 3 |
2023-04-06 |
| suricata |
ET HUNTING Downloaded Powershell Script Detects AV Product |
rev 1 |
2023-04-06 |
| suricata |
ET HUNTING Suspicious Netlify Hosted GET Request - Possible Phishing Landing |
rev 3 |
2023-04-06 |
| sigma |
Arbitrary MSI Download Via Devinit.EXE |
test |
2023-04-06 |
| sigma |
Audio Capture via PowerShell |
test |
2023-04-06 |
| sigma |
PowerShell Base64 Encoded FromBase64String Cmdlet |
test |
2023-04-06 |
| sigma |
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call |
test |
2023-04-06 |