| sigma |
System Information Discovery - Auditd |
test |
2023-03-06 |
| sigma |
Potential CommandLine Path Traversal Via Cmd.EXE |
test |
2023-03-06 |
| sigma |
Remote Access Tool - NetSupport Execution |
test |
2023-03-06 |
| sigma |
Potential Dosfuscation Activity |
test |
2023-03-06 |
| sigma |
Private Keys Reconnaissance Via CommandLine Tools |
test |
2023-03-06 |
| sigma |
VolumeShadowCopy Symlink Creation Via Mklink |
stable |
2023-03-06 |
| sigma |
Change Default File Association Via Assoc |
test |
2023-03-06 |
| sigma |
Change Default File Association To Executable Via Assoc |
test |
2023-03-06 |
| sigma |
Remote Access Tool - LogMeIn Execution |
test |
2023-03-05 |
| sigma |
Stop Windows Service Via Net.EXE |
test |
2023-03-05 |
| sigma |
Remote Access Tool - ScreenConnect Execution |
test |
2023-03-05 |
| sigma |
Start Windows Service Via Net.EXE |
test |
2023-03-05 |
| sigma |
Remote Access Tool - AnyDesk Piped Password Via CLI |
test |
2023-03-05 |
| sigma |
Remote Access Tool - AnyDesk Silent Installation |
test |
2023-03-05 |
| sigma |
Remote Access Tool - GoToAssist Execution |
test |
2023-03-05 |
| sigma |
PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE |
test |
2023-03-05 |
| sigma |
PUA - Potential PE Metadata Tamper Using Rcedit |
test |
2023-03-05 |
| sigma |
Potential Persistence Via Event Viewer Events.asp |
test |
2023-03-05 |
| sigma |
Remote Access Tool - RURAT Execution From Unusual Location |
test |
2023-03-05 |
| sigma |
PUA - Rclone Execution |
test |
2023-03-05 |
| sigma |
Stop Windows Service Via PowerShell Stop-Service |
test |
2023-03-05 |
| sigma |
HackTool - F-Secure C3 Load by Rundll32 |
test |
2023-03-05 |
| sigma |
HackTool - Sliver C2 Implant Activity Pattern |
test |
2023-03-05 |
| sigma |
New Root Certificate Installed Via CertMgr.EXE |
test |
2023-03-05 |
| elastic |
Potential Shell via Web Server |
deprecated |
2023-03-04 |
| sigma |
Service StartupType Change Via Sc.EXE |
test |
2023-03-04 |
| sigma |
Service StartupType Change Via PowerShell Set-Service |
test |
2023-03-04 |
| sigma |
Remote Code Execute via Winrm.vbs |
test |
2023-03-03 |
| sigma |
HackTool - Default PowerSploit/Empire Scheduled Task Creation |
test |
2023-03-03 |
| sigma |
Potential Commandline Obfuscation Using Escape Characters |
test |
2023-03-03 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.dyn .mk Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.punkassgamers .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.v0id .nl Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.serveirc .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.is-a-bruinsfan .org Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.chesta .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.infocommthailand .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.portalwebvillamercedes .gob .ar Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.3dxtras .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.priamaakcia .sk Domain |
rev 2 |
2023-03-02 |