| snort |
ET TROJAN Win32/WhiskerSpy - FTP - Observed Creds |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/Stealc Requesting browsers Config from C2 |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - Key Material Upload |
rev 1 |
2023-02-20 |
| snort |
ET TROJAN Win32/WhiskerSpy - Task Request |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - Task Request |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/Stealc Submitting Screenshot to C2 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - FTP STOR Command M2 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - FTP STOR Command M1 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/Stealc Submitting System Information to C2 |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - FTP - Observed Creds |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - Machine ID Registration |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE Win32/WhiskerSpy - Key Material Upload |
rev 1 |
2023-02-20 |
| suricata |
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in |
rev 1 |
2023-02-20 |
| sigma |
APT29 2018 Phishing Campaign File Indicators |
stable |
2023-02-20 |
| sigma |
Invoke-Obfuscation CLIP+ Launcher - System |
test |
2023-02-20 |
| sigma |
New Service Creation Using PowerShell |
test |
2023-02-20 |
| sigma |
Potential Network Sniffing Activity Using Network Tools |
test |
2023-02-20 |
| sigma |
Creation Of A Local User Account |
test |
2023-02-18 |
| sigma |
Suspicious Installer Package Child Process |
test |
2023-02-18 |
| sigma |
Guest Account Enabled Via Sysadminctl |
test |
2023-02-18 |
| sigma |
Potential Persistence Via PlistBuddy |
test |
2023-02-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.myftp .biz Domain |
rev 5 |
2023-02-17 |
| snort |
ET CURRENT_EVENTS TA399/SideWinder Credential Phish Landing Page M2 2023-02-16 |
rev 1 |
2023-02-17 |
| suricata |
ET PHISHING TA399/SideWinder Credential Phish Landing Page M2 2023-02-16 |
rev 1 |
2023-02-17 |
| sigma |
Binary Padding - MacOS |
test |
2023-02-17 |
| sigma |
Pingback Backdoor File Indicators |
test |
2023-02-17 |
| sigma |
Pingback Backdoor Activity |
test |
2023-02-17 |
| sigma |
Pingback Backdoor DLL Loading Activity |
test |
2023-02-17 |
| sigma |
Potential PrintNightmare Exploitation Attempt |
test |
2023-02-17 |
| sigma |
Potential DLL Sideloading Via VMware Xfer |
test |
2023-02-17 |
| sigma |
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE |
test |
2023-02-17 |
| sigma |
Dynamic CSharp Compile Artefact |
test |
2023-02-17 |
| sigma |
Suspicious Renamed Comsvcs DLL Loaded By Rundll32 |
test |
2023-02-17 |
| sigma |
DLL Loaded From Suspicious Location Via Cmspt.EXE |
test |
2023-02-17 |
| sigma |
HackTool - SILENTTRINITY Stager DLL Load |
test |
2023-02-17 |
| snort |
ET TROJAN APT28 Zebrocy/Zekapab CnC Checkin |
rev 2 |
2023-02-16 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.khabdha .org domain |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN Possible APT29 Compressed Payload Download Request |
rev 1 |
2023-02-16 |