| sigma |
Suspicious Process Created Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Hardware Model Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Suspicious WMIC Execution Via Office Process |
test |
2023-02-14 |
| sigma |
Suspicious WindowsTerminal Child Processes |
test |
2023-02-14 |
| sigma |
Potential SMB Relay Attack Tool Execution |
test |
2023-02-14 |
| sigma |
PUA - WebBrowserPassView Execution |
test |
2023-02-14 |
| sigma |
PUA - CleanWipe Execution |
test |
2023-02-14 |
| sigma |
Renamed CreateDump Utility Execution |
test |
2023-02-14 |
| sigma |
Suspicious Obfuscated PowerShell Code |
test |
2023-02-14 |
| sigma |
Local Groups Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Potential NTLM Coercion Via Certutil.EXE |
test |
2023-02-14 |
| sigma |
Windows Hotfix Updates Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Computer System Reconnaissance Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
Service Started/Stopped Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
HackTool - SharpView Execution |
test |
2023-02-14 |
| sigma |
HackTool - SharpEvtMute Execution |
test |
2023-02-14 |
| sigma |
Potential Windows Defender Tampering Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
PUA - RunXCmd Execution |
test |
2023-02-14 |
| sigma |
Renamed SysInternals DebugView Execution |
test |
2023-02-14 |
| sigma |
PUA - Wsudo Suspicious Execution |
test |
2023-02-14 |
| sigma |
HackTool - SharpLDAPmonitor Execution |
test |
2023-02-14 |
| sigma |
Netsh Allow Group Policy on Microsoft Defender Firewall |
test |
2023-02-14 |
| sigma |
Windows Binary Executed From WSL |
test |
2023-02-14 |
| suricata |
ET MALWARE zgRAT / PureLogs CnC Activity M3 |
rev 1 |
2023-02-13 |
| snort |
ET INFO Iperius Remote Related Domain in DNS Lookup |
rev 1 |
2023-02-13 |
| snort |
ET INFO Observed Query to .beauty TLD |
rev 1 |
2023-02-13 |
| snort |
ET INFO Observed Iperius Remote Domain in TLS SNI |
rev 1 |
2023-02-13 |
| suricata |
ET HUNTING Observed Query to .beauty TLD |
rev 1 |
2023-02-13 |
| sigma |
Windows Firewall Disabled via PowerShell |
test |
2023-02-13 |
| sigma |
HackTool - SILENTTRINITY Stager Execution |
test |
2023-02-13 |
| sigma |
HackTool - TruffleSnout Execution |
test |
2023-02-13 |
| sigma |
HackTool - WinRM Access Via Evil-WinRM |
test |
2023-02-13 |
| sigma |
HackTool - CrackMapExec Process Patterns |
test |
2023-02-13 |
| sigma |
Potential CVE-2022-21587 Exploitation Attempt |
test |
2023-02-13 |
| sigma |
Firewall Disabled via Netsh.EXE |
test |
2023-02-13 |
| sigma |
Potential Maze Ransomware Activity |
test |
2023-02-13 |
| sigma |
RDP Port Forwarding Rule Added Via Netsh.EXE |
test |
2023-02-13 |
| sigma |
PUA - NirCmd Execution |
test |
2023-02-13 |
| sigma |
PUA - NSudo Execution |
test |
2023-02-13 |
| sigma |
Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt |
test |
2023-02-13 |