| sigma |
BITS Transfer Job Download From Direct IP |
test |
2023-03-27 |
| sigma |
BITS Transfer Job Downloading File Potential Suspicious Extension |
test |
2023-03-27 |
| sigma |
New BITS Job Created Via Bitsadmin |
test |
2023-03-27 |
| sigma |
BITS Transfer Job Download To Potential Suspicious Folder |
test |
2023-03-27 |
| sigma |
New BITS Job Created Via PowerShell |
test |
2023-03-27 |
| snort |
ET TROJAN MAGICHOUND.MPK Activity via IRC |
rev 2 |
2023-03-24 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-24 |
| snort |
ET TROJAN APT28 DealersChoice DNS Lookup |
rev 2 |
2023-03-24 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-24 |
| snort |
ET MALWARE Win32/DealPly.EJ Checkin |
rev 1 |
2023-03-24 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-24 |
| snort |
ET TROJAN APT28 DealersChoice DNS Lookup |
rev 2 |
2023-03-24 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-24 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-24 |
| suricata |
ET MALWARE MAGICHOUND.MPK Activity via IRC |
rev 2 |
2023-03-24 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-24 |
| suricata |
ET ADWARE_PUP Win32/DealPly.EJ Checkin |
rev 1 |
2023-03-24 |
| sigma |
Potential CVE-2021-26084 Exploitation Attempt |
test |
2023-03-24 |
| sigma |
Exchange PowerShell Snap-Ins Usage |
test |
2023-03-24 |
| sigma |
Potential CVE-2021-27905 Exploitation Attempt |
test |
2023-03-24 |
| snort |
ET MALWARE Win32/Packed.FlyStudio.AA Checkin |
rev 1 |
2023-03-23 |
| snort |
ET TROJAN TrojanDownloader:Win32/Sinresby.B Checkin |
rev 1 |
2023-03-23 |
| suricata |
ET ADWARE_PUP Win32/Packed.FlyStudio.AA Checkin |
rev 1 |
2023-03-23 |
| sigma |
WmiPrvSE Spawned A Process |
stable |
2023-03-23 |
| sigma |
HackTool - winPEAS Execution |
test |
2023-03-23 |
| snort |
ET TROJAN DarkCloud Stealer File Grabber Function Exfiltrating Data via Telegram |
rev 1 |
2023-03-22 |
| snort |
ET TROJAN DarkCloud Stealer FirefoxCookies.json Exfiltration via Telegram |
rev 1 |
2023-03-22 |
| snort |
ET TROJAN Win64/TrojanDownloader.AHK.CH Checkin |
rev 1 |
2023-03-22 |
| snort |
ET MOBILE_MALWARE Android/Spy.Banker.BTO CnC Domain in DNS Lookup |
rev 1 |
2023-03-22 |
| suricata |
ET MALWARE Win64/TrojanDownloader.AHK.CH Checkin |
rev 1 |
2023-03-22 |
| sigma |
CVE-2023-23397 Exploitation Attempt |
test |
2023-03-22 |
| sigma |
Suspicious Program Names |
test |
2023-03-22 |
| snort |
ET TROJAN Generic Credential Phish Landing Page 2023-03-21 |
rev 1 |
2023-03-21 |
| snort |
ET CURRENT_EVENTS Snapchat Credential Phish Landing Page 2023-03-21 |
rev 1 |
2023-03-21 |
| suricata |
ET PHISHING Snapchat Credential Phish Landing Page 2023-03-21 |
rev 1 |
2023-03-21 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-03-21 |
rev 1 |
2023-03-21 |
| sigma |
Potential Iviewers.DLL Sideloading |
test |
2023-03-21 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-20 |
| snort |
ET TROJAN Unknown Powershell Profiler Exfiltrating System Data |
rev 1 |
2023-03-20 |
| snort |
ET TROJAN Ares Loader Observed User-Agent M2 |
rev 1 |
2023-03-20 |