| suricata |
ET MALWARE Win32/Unknown Stealer CnC Exfil via Telegram M2 |
rev 1 |
2023-03-15 |
| suricata |
ET MALWARE Win32/Unknown Stealer CnC Exfil via Telegram M1 |
rev 1 |
2023-03-15 |
| suricata |
ET HUNTING HTA Download with PowerShell User-Agent |
rev 1 |
2023-03-15 |
| sigma |
Unix Shell Configuration Modification |
test |
2023-03-15 |
| sigma |
DPAPI Domain Master Key Backup Attempt |
test |
2023-03-15 |
| sigma |
Aruba Network Service Potential DLL Sideloading |
test |
2023-03-15 |
| sigma |
Potential Rcdll.DLL Sideloading |
test |
2023-03-15 |
| sigma |
Microsoft Office DLL Sideload |
test |
2023-03-15 |
| snort |
ET TROJAN Win32/HMR RAT Sending System Information M4 |
rev 1 |
2023-03-14 |
| snort |
ET TROJAN Linux DarkRadiation Ransomware Telegram Activity M3 |
rev 1 |
2023-03-14 |
| snort |
ET INFO playit .gg Tunneling Domain in DNS Lookup |
rev 1 |
2023-03-14 |
| snort |
ET TROJAN Possible Linux DarkRadiation Ransomware Telegram Activity |
rev 1 |
2023-03-14 |
| snort |
ET INFO Curl User-Agent Observed to Telegram |
rev 1 |
2023-03-14 |
| snort |
ET TROJAN Win32/HMR RAT Sending System Information M3 |
rev 1 |
2023-03-14 |
| snort |
ET TROJAN SIDESHOW CnC Authentication Over HTTP |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Win32/HMR RAT Sending System Information M3 |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE SIDESHOW CnC Authentication Over HTTP |
rev 1 |
2023-03-14 |
| suricata |
ET INFO playit .gg Tunneling Domain in DNS Lookup |
rev 1 |
2023-03-14 |
| suricata |
ET HUNTING Curl User-Agent Observed to Telegram |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Possible Linux DarkRadiation Ransomware Telegram Activity |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Linux DarkRadiation Ransomware Telegram Activity M3 |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Win32/HMR RAT Sending System Information M4 |
rev 1 |
2023-03-14 |
| suricata |
ET MALWARE Linux DarkRadiation Ransomware Telegram Activity M1 |
rev 1 |
2023-03-14 |
| sigma |
Import LDAP Data Interchange Format File Via Ldifde.EXE |
test |
2023-03-14 |
| sigma |
Active Directory Structure Export Via Ldifde.EXE |
test |
2023-03-14 |
| sigma |
First Time Seen Remote Named Pipe |
test |
2023-03-14 |
| sigma |
Hiding Files with Attrib.exe |
test |
2023-03-14 |
| sigma |
Set Suspicious Files as System Files Using Attrib.EXE |
test |
2023-03-14 |
| sigma |
Process Memory Dump Via Dotnet-Dump |
test |
2023-03-14 |
| sigma |
Active Directory Structure Export Via Csvde.EXE |
test |
2023-03-14 |
| sigma |
Set Files as System Files Using Attrib.EXE |
test |
2023-03-14 |
| snort |
ET CURRENT_EVENTS Observed DNS Query to Possible Phish Hosted on onlinehome.us |
rev 1 |
2023-03-13 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-03-13 |
rev 1 |
2023-03-13 |
| snort |
ET TROJAN Win32/HMR RAT Sending System Information M2 |
rev 1 |
2023-03-13 |
| snort |
ET TROJAN Win32/HMR RAT Sending System Information |
rev 1 |
2023-03-13 |
| snort |
ET CURRENT_EVENTS Scam Redirect Domain in DNS Lookup |
rev 1 |
2023-03-13 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-03-13 |
rev 1 |
2023-03-13 |
| suricata |
ET PHISHING Observed DNS Query to Possible Phish Hosted on onlinehome.us |
rev 1 |
2023-03-13 |
| suricata |
ET PHISHING Scam Redirect Domain in DNS Lookup |
rev 1 |
2023-03-13 |
| suricata |
ET MALWARE Win32/HMR RAT Sending System Information M2 |
rev 1 |
2023-03-13 |