| sigma |
New User Created Via Net.EXE |
test |
2023-02-21 |
| sigma |
New User Created Via Net.EXE With Never Expire Option |
test |
2023-02-21 |
| sigma |
PUA - Adidnsdump Execution |
test |
2023-02-21 |
| sigma |
Windows Share Mount Via Net.EXE |
test |
2023-02-21 |
| sigma |
Share And Session Enumeration Using Net.EXE |
stable |
2023-02-21 |
| sigma |
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE |
test |
2023-02-21 |
| sigma |
Password Provided In Command Line Of Net.EXE |
test |
2023-02-21 |
| sigma |
System Network Connections Discovery Via Net.EXE |
test |
2023-02-21 |
| sigma |
Suspicious Manipulation Of Default Accounts Via Net.EXE |
test |
2023-02-21 |
| sigma |
Suspicious Mshta.EXE Execution Patterns |
test |
2023-02-21 |
| sigma |
Deleted Data Overwritten Via Cipher.EXE |
test |
2023-02-21 |
| sigma |
Suspicious Curl.EXE Download |
test |
2023-02-21 |
| sigma |
Windows Admin Share Mount Via Net.EXE |
test |
2023-02-21 |
| sigma |
Curl.EXE Execution With Custom UserAgent |
test |
2023-02-21 |
| sigma |
Curl.EXE Execution |
test |
2023-02-21 |
| sigma |
File Download Via Curl.EXE |
test |
2023-02-21 |
| sigma |
HackTool - Mimikatz Execution |
test |
2023-02-21 |
| sigma |
HackTool - Potential Impacket Lateral Movement Activity |
stable |
2023-02-21 |
| sigma |
HackTool - Empire PowerShell UAC Bypass |
stable |
2023-02-21 |
| sigma |
HackTool - Empire PowerShell Launch Parameters |
test |
2023-02-21 |
| sigma |
HackTool - CrackMapExec PowerShell Obfuscation |
test |
2023-02-21 |
| sigma |
HackTool - Covenant PowerShell Launcher |
test |
2023-02-21 |
| sigma |
Potential Emotet Rundll32 Execution |
test |
2023-02-21 |
| sigma |
PUA - 3Proxy Execution |
test |
2023-02-21 |
| sigma |
PUA - AdvancedRun Execution |
test |
2023-02-21 |
| sigma |
PUA - AdvancedRun Suspicious Execution |
test |
2023-02-21 |
| sigma |
PUA - CsExec Execution |
test |
2023-02-21 |
| sigma |
PUA - DIT Snapshot Viewer |
test |
2023-02-21 |
| sigma |
PUA - Mouse Lock Execution |
test |
2023-02-21 |
| sigma |
PUA - Ngrok Execution |
test |
2023-02-21 |
| sigma |
Unmount Share Via Net.EXE |
test |
2023-02-21 |
| sigma |
Suspicious File Execution From Internet Hosted WebDav Share |
test |
2023-02-21 |
| sigma |
Data Copied To Clipboard Via Clip.EXE |
test |
2023-02-21 |
| sigma |
Audit Policy Tampering Via NT Resource Kit Auditpol |
test |
2023-02-21 |
| snort |
ET TROJAN Win32/WhiskerSpy - FTP STOR Command M1 |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/Stealc Requesting plugins Config from C2 |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy CnC Activity |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - Machine ID Registration |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - Key Material Upload |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in |
rev 1 |
2023-02-20 |