| snort |
ET TROJAN MalDoc/Gamaredon CnC Activity M2 |
rev 1 |
2023-03-29 |
| snort |
ET TROJAN MalDoc/Gamaredon CnC Activity M3 |
rev 1 |
2023-03-29 |
| snort |
ET TROJAN MalDoc/Gamaredon CnC Activity M1 |
rev 1 |
2023-03-29 |
| suricata |
ET ADWARE_PUP Win32/VrBrothers Checkin |
rev 1 |
2023-03-29 |
| sigma |
Potential Compromised 3CXDesktopApp Update Activity |
test |
2023-03-29 |
| sigma |
Potential CobaltStrike Process Patterns |
test |
2023-03-29 |
| sigma |
Potential Arbitrary DLL Load Using Winword |
test |
2023-03-29 |
| sigma |
Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32 |
test |
2023-03-29 |
| sigma |
App Granted Privileged Delegated Or App Permissions |
test |
2023-03-29 |
| sigma |
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell |
stable |
2023-03-29 |
| sigma |
Potential Suspicious Child Process Of 3CXDesktopApp |
test |
2023-03-29 |
| sigma |
Potential Command Line Path Traversal Evasion Attempt |
test |
2023-03-29 |
| sigma |
CLR DLL Loaded Via Office Applications |
test |
2023-03-29 |
| sigma |
DotNET Assembly DLL Loaded Via Office Application |
test |
2023-03-29 |
| sigma |
Windows Shell/Scripting Application File Write to Suspicious Folder |
test |
2023-03-29 |
| snort |
ET INFO HTTP GET Request for system.data.sqlite.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| snort |
ET INFO HTTP GET Request for sqlite.interop.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| snort |
ET INFO HTTP GET Request for bouncycastle.crypto.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| snort |
ET INFO Possible Successful Credential Phish - Form submitted to submit-form Form Hosting |
rev 3 |
2023-03-28 |
| snort |
ET INFO HTTP GET Request for newtonsoft.json.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| snort |
ET INFO Connectivity Check With Go User-Agent |
rev 1 |
2023-03-28 |
| snort |
ET INFO HTTP GET Request for dotnetzip.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| suricata |
ET HUNTING HTTP GET Request for sqlite.interop.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| suricata |
ET HUNTING HTTP GET Request for dotnetzip.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| suricata |
ET HUNTING HTTP GET Request for newtonsoft.json.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| suricata |
ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1 |
rev 9 |
2023-03-28 |
| suricata |
ET HUNTING HTTP GET Request for system.data.sqlite.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| suricata |
ET HUNTING HTTP GET Request for bouncycastle.crypto.dll - Possible Infostealer Activity |
rev 1 |
2023-03-28 |
| suricata |
ET PHISHING Possible Successful Credential Phish - Form submitted to submit-form Form Hosting |
rev 3 |
2023-03-28 |
| snort |
ET INFO PowerShell Command Prompt Outbound On High Port |
rev 1 |
2023-03-27 |
| snort |
ET TROJAN Win32/Inido!rts Checkin |
rev 1 |
2023-03-27 |
| snort |
ET INFO Whoami Command Inbound On High Port |
rev 1 |
2023-03-27 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2022-10-11 |
rev 2 |
2023-03-27 |
| snort |
ET TROJAN Suspected Muggle Stealer Activity M2 |
rev 1 |
2023-03-27 |
| snort |
ET TROJAN Suspected Muggle Stealer Activity M1 |
rev 1 |
2023-03-27 |
| snort |
ET TROJAN Snake Keylogger Exfil via SMTP |
rev 1 |
2023-03-27 |
| suricata |
ET HUNTING PowerShell Command Prompt Outbound On High Port |
rev 1 |
2023-03-27 |
| suricata |
ET MALWARE Snake Keylogger Exfil via SMTP |
rev 1 |
2023-03-27 |
| suricata |
ET PHISHING Successful Generic Credential Phish 2022-10-11 |
rev 2 |
2023-03-27 |
| suricata |
ET HUNTING Whoami Command Inbound On High Port |
rev 1 |
2023-03-27 |