| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.khabdha .org domain |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN APT28 DealersChoice CnC Beacon Response |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN Possible APT29 Compressed Payload Download Request |
rev 1 |
2023-02-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.satelit .org domain |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.apocalypto .org .uk domain |
rev 1 |
2023-02-16 |
| suricata |
ET PHISHING myGov Credential Phish 2023-02-15 |
rev 1 |
2023-02-16 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-16 |
| elastic |
Google Workspace User Group Access Modified to Allow External Access |
deprecated |
2023-02-16 |
| sigma |
Tomcat WebServer Logs Deleted |
test |
2023-02-16 |
| snort |
ET TROJAN Winter Vivern Retrieving Commands |
rev 2 |
2023-02-15 |
| snort |
ET TROJAN OSX/iWebUpdate CnC Activity |
rev 1 |
2023-02-15 |
| suricata |
ET MALWARE OSX/iWebUpdate CnC Activity |
rev 1 |
2023-02-15 |
| sigma |
File Deleted Via Sysinternals SDelete |
test |
2023-02-15 |
| sigma |
Suspicious Download From Direct IP Via Bitsadmin |
test |
2023-02-15 |
| sigma |
Unusual File Deletion by Dns.exe |
test |
2023-02-15 |
| sigma |
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE |
test |
2023-02-15 |
| sigma |
Boot Configuration Tampering Via Bcdedit.EXE |
stable |
2023-02-15 |
| sigma |
File Download Via Bitsadmin |
test |
2023-02-15 |
| sigma |
IIS WebServer Access Logs Deleted |
test |
2023-02-15 |
| sigma |
EventLog EVTX File Deleted |
test |
2023-02-15 |
| sigma |
PowerShell Console History Logs Deleted |
test |
2023-02-15 |
| sigma |
Backup Files Deleted |
test |
2023-02-15 |
| sigma |
TeamViewer Log File Deleted |
test |
2023-02-15 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| snort |
ET TROJAN IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET HUNTING Suspicious Windows Executable WriteProcessMemory |
rev 6 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| suricata |
ET MALWARE IcedID CnC Domain in DNS Lookup |
rev 1 |
2023-02-14 |
| sigma |
Suspicious Process Created Via Wmic.EXE |
test |
2023-02-14 |