| snort |
ET TROJAN Ares Loader Checkin |
rev 1 |
2023-03-20 |
| snort |
ET TROJAN Ares Loader Observed User-Agent M1 |
rev 1 |
2023-03-20 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-03-20 |
| suricata |
ET MALWARE Ares Loader Observed User-Agent M2 |
rev 1 |
2023-03-20 |
| suricata |
ET MALWARE Ares Loader Checkin |
rev 1 |
2023-03-20 |
| suricata |
ET MALWARE Ares Loader Observed User-Agent M1 |
rev 1 |
2023-03-20 |
| suricata |
ET MALWARE Unknown Powershell Profiler Exfiltrating System Data |
rev 1 |
2023-03-20 |
| sigma |
Potential MFA Bypass Using Legacy Client Authentication |
test |
2023-03-20 |
| sigma |
User Added To Admin Group Via Sysadminctl |
test |
2023-03-19 |
| sigma |
User Added To Admin Group Via Dscl |
test |
2023-03-19 |
| sigma |
Potential ACTINIUM Persistence Activity |
test |
2023-03-18 |
| snort |
ET TROJAN Fortigate TABLEFLIP Backdoor Trigger - Magic Number Sequence |
rev 1 |
2023-03-17 |
| snort |
ET CURRENT_EVENTS Silicon Valley Bank Credential Phish Landing Page M1 |
rev 1 |
2023-03-17 |
| snort |
ET TROJAN Golang/Linux Kaiji Variant Activity |
rev 1 |
2023-03-17 |
| snort |
ET TROJAN Fortigate THINCRUST Backdoor Activity M1 |
rev 1 |
2023-03-17 |
| snort |
ET TROJAN Fortigate THINCRUST Backdoor Activity M2 |
rev 1 |
2023-03-17 |
| snort |
ET CURRENT_EVENTS Silicon Valley Bank Credential Phish Landing Page M2 |
rev 1 |
2023-03-17 |
| suricata |
ET PHISHING Silicon Valley Bank Credential Phish Landing Page M1 |
rev 1 |
2023-03-17 |
| suricata |
ET PHISHING Silicon Valley Bank Credential Phish Landing Page M2 |
rev 1 |
2023-03-17 |
| suricata |
ET MALWARE Fortigate THINCRUST Backdoor Activity M1 |
rev 1 |
2023-03-17 |
| suricata |
ET MALWARE Fortigate TABLEFLIP Backdoor Trigger - Magic Number Sequence |
rev 1 |
2023-03-17 |
| suricata |
ET MALWARE Golang/Linux Kaiji Variant Activity |
rev 1 |
2023-03-17 |
| suricata |
ET MALWARE Fortigate THINCRUST Backdoor Activity M2 |
rev 1 |
2023-03-17 |
| snort |
ET TROJAN Winter Vivern APT Aperetif Payload Retrieval Attempt M2 |
rev 1 |
2023-03-16 |
| snort |
ET MOBILE_MALWARE Android/FakeCalls CnC Server Response |
rev 1 |
2023-03-16 |
| snort |
ET TROJAN Winter Vivern APT Aperetif CnC Checkin |
rev 1 |
2023-03-16 |
| snort |
ET TROJAN Winter Vivern APT Aperetif Payload Retrieval Attempt M1 |
rev 1 |
2023-03-16 |
| snort |
ET CURRENT_EVENTS EDD Credential Phish Landing Page M2 2023-03-16 |
rev 1 |
2023-03-16 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-03-16 |
rev 1 |
2023-03-16 |
| snort |
ET INFO Observed OpenDrive Cloud Storage SSL Cert |
rev 1 |
2023-03-16 |
| suricata |
ET MALWARE Winter Vivern APT Aperetif CnC Checkin |
rev 1 |
2023-03-16 |
| suricata |
ET PHISHING EDD Credential Phish Landing Page M2 2023-03-16 |
rev 1 |
2023-03-16 |
| suricata |
ET MOBILE_MALWARE Android/FakeCalls CnC Server Response |
rev 1 |
2023-03-16 |
| suricata |
ET MALWARE Winter Vivern APT Aperetif Payload Retrieval Attempt M2 |
rev 1 |
2023-03-16 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-03-16 |
rev 1 |
2023-03-16 |
| suricata |
ET MALWARE Winter Vivern APT Aperetif Payload Retrieval Attempt M1 |
rev 1 |
2023-03-16 |
| sigma |
Suspicious Network Communication With IPFS |
test |
2023-03-16 |
| snort |
ET INFO HTA Download with PowerShell User-Agent |
rev 1 |
2023-03-15 |
| snort |
ET TROJAN Win32/Unknown Stealer CnC Exfil via Telegram M2 |
rev 1 |
2023-03-15 |
| snort |
ET TROJAN Win32/Unknown Stealer CnC Exfil via Telegram M1 |
rev 1 |
2023-03-15 |