| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.from-nj .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.nx .tc Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.home .kg Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.istmein .de Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.surfnet .ca Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.servebbs .org Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.saucedchicago .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dockl .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.joecampanaro .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.womenclothingtoday .com Domain |
rev 2 |
2023-03-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.morganisageek .org Domain |
rev 2 |
2023-03-02 |
| suricata |
ET ADWARE_PUP Win32/Presenoker Checkin |
rev 1 |
2023-03-02 |
| suricata |
ET ATTACK_RESPONSE VBS/TrojanDownloader.Agent.YLH Payload Inbound |
rev 1 |
2023-03-02 |
| sigma |
Potential Credential Dumping Via LSASS Process Clone |
test |
2023-03-02 |
| sigma |
User Added to Local Administrators Group |
test |
2023-03-02 |
| sigma |
Potential Suspicious Execution From GUID Like Folder Names |
test |
2023-03-02 |
| sigma |
Suspicious Group And Account Reconnaissance Activity Using Net.EXE |
test |
2023-03-02 |
| sigma |
Arbitrary Binary Execution Using GUP Utility |
test |
2023-03-02 |
| sigma |
File Download Using Notepad++ GUP Utility |
test |
2023-03-02 |
| snort |
ET CURRENT_EVENTS Successful CenturyLink Credential Phish 2023-03-01 |
rev 1 |
2023-03-01 |
| snort |
ET TROJAN Observed BlackLotus SSL Certificate Observed |
rev 1 |
2023-03-01 |
| suricata |
ET PHISHING Successful CenturyLink Credential Phish 2023-03-01 |
rev 1 |
2023-03-01 |
| sigma |
HackTool - RedMimicry Winnti Playbook Execution |
test |
2023-03-01 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Tilde Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Percent Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Comma Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Dash Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Single Quote Separated |
rev 1 |
2023-02-28 |
| snort |
ET TROJAN NDSW/NDSX Javascript Inject |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Octothorp Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Backtick Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Pipe Separated |
rev 1 |
2023-02-28 |
| snort |
ET INFO Likely Hex Encoded Executable as String - Double Quote Separated |
rev 1 |
2023-02-28 |
| snort |
ET TROJAN ReverseRat 3.0 CnC Checkin M2 |
rev 1 |
2023-02-28 |
| snort |
ET TROJAN ReverseRat 3.0 CnC Checkin M1 |
rev 1 |
2023-02-28 |
| snort |
ET CURRENT_EVENTS Successful Ionos Credential Phish 2023-02-28 |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Double Quote Separated |
rev 1 |
2023-02-28 |
| suricata |
ET PHISHING Successful Ionos Credential Phish 2023-02-28 |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Pipe Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Single Quote Separated |
rev 1 |
2023-02-28 |