| snort |
ET INFO HTTP GET Request for freebl3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET INFO Clearbit Logo Query in DNS Lookup |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for msvcp40.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M3 2023-02-22 |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M1 2023-02-22 |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for sqlite3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for mozglue.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET INFO HTTP GET Request for nss3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M4 2023-02-22 |
rev 1 |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M2 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M4 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-22 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M3 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M2 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET PHISHING Successful Generic Credential Phish M1 2023-02-22 |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for msvcp40.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| suricata |
ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity |
rev 1 |
2023-02-22 |
| sigma |
System Drawing DLL Load |
test |
2023-02-22 |
| sigma |
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load |
test |
2023-02-22 |
| sigma |
Office Macro File Creation From Suspicious Process |
test |
2023-02-22 |
| sigma |
Potential Persistence Via Outlook Form |
test |
2023-02-22 |
| sigma |
Audit Policy Tampering Via Auditpol |
test |
2023-02-22 |
| sigma |
HackTool - Jlaive In-Memory Assembly Execution |
test |
2023-02-22 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M2 2023-02-22 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page M2 2023-02-22 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish M1 2023-02-22 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page M1 2023-02-22 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2023-02-21 |
rev 1 |
2023-02-21 |
| snort |
ET CURRENT_EVENTS TA399/SideWinder Credential Phish Landing Page M1 2023-02-16 |
rev 1 |
2023-02-21 |
| suricata |
ET PHISHING TA399/SideWinder Credential Phish Landing Page M1 2023-02-16 |
rev 1 |
2023-02-21 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page M1 2023-02-22 |
rev 1 |
2023-02-21 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2023-02-21 |
rev 1 |
2023-02-21 |