| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Dash Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Percent Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Backtick Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Tilde Separated |
rev 1 |
2023-02-28 |
| suricata |
ET EXPLOIT_KIT NDSW/NDSX Javascript Inject |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Octothorp Separated |
rev 1 |
2023-02-28 |
| suricata |
ET HUNTING Likely Hex Encoded Executable as String - Comma Separated |
rev 1 |
2023-02-28 |
| sigma |
Group Membership Reconnaissance Via Whoami.EXE |
test |
2023-02-28 |
| sigma |
Security Privileges Enumeration Via Whoami.EXE |
test |
2023-02-28 |
| sigma |
Psexec Execution |
test |
2023-02-28 |
| sigma |
Potential File Overwrite Via Sysinternals SDelete |
test |
2023-02-28 |
| sigma |
PsExec Service Child Process Execution as LOCAL SYSTEM |
test |
2023-02-28 |
| sigma |
PsExec Service Execution |
test |
2023-02-28 |
| sigma |
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE |
test |
2023-02-28 |
| sigma |
Suspicious Parent Double Extension File Execution |
test |
2023-02-28 |
| sigma |
Service Security Descriptor Tampering Via Sc.EXE |
test |
2023-02-28 |
| sigma |
Rundll32 Execution Without Parameters |
test |
2023-02-28 |
| snort |
ET TROJAN Win32/Grandoreiro TCP CnC Activity |
rev 1 |
2023-02-27 |
| snort |
ET TROJAN Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M2 |
rev 1 |
2023-02-27 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2023-02-27 |
rev 1 |
2023-02-27 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-02-27 |
rev 1 |
2023-02-27 |
| snort |
ET TROJAN Win32/VB.AAF Checkin |
rev 1 |
2023-02-27 |
| snort |
ET TROJAN Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M1 |
rev 1 |
2023-02-27 |
| snort |
ET TROJAN Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M3 |
rev 1 |
2023-02-27 |
| snort |
ET INFO User-Agent with Non Standard Characters |
rev 1 |
2023-02-27 |
| snort |
ET CURRENT_EVENTS Successful Orange.fr Credential Phish 2023-02-27 |
rev 1 |
2023-02-27 |
| suricata |
ET PHISHING Successful Orange.fr Credential Phish 2023-02-27 |
rev 1 |
2023-02-27 |
| suricata |
ET MALWARE Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M1 |
rev 1 |
2023-02-27 |
| suricata |
ET MALWARE Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M2 |
rev 1 |
2023-02-27 |
| suricata |
ET MALWARE Win32/S1deload Stealer CnC Checkin - Coinminer Payload Retrieval M3 |
rev 1 |
2023-02-27 |
| suricata |
ET MALWARE Win32/Grandoreiro TCP CnC Activity |
rev 1 |
2023-02-27 |
| suricata |
ET MALWARE Win32/VB.AAF Checkin |
rev 1 |
2023-02-27 |
| suricata |
ET HUNTING User-Agent with Non Standard Characters |
rev 1 |
2023-02-27 |
| suricata |
ET PHISHING Successful Generic Credential Phish 2023-02-27 |
rev 1 |
2023-02-27 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-02-27 |
rev 1 |
2023-02-27 |
| sigma |
Suspicious File Created Via OneNote Application |
test |
2023-02-27 |
| snort |
ET CURRENT_EVENTS Coinbase Credential Phish 2023-02-24 |
rev 1 |
2023-02-24 |
| snort |
ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup |
rev 1 |
2023-02-24 |
| snort |
ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup |
rev 1 |
2023-02-24 |
| snort |
ET CURRENT_EVENTS TA453 Phishing Domain in DNS Lookup |
rev 1 |
2023-02-24 |