| sigma |
Rundll32 Registered COM Objects |
test |
2023-02-09 |
| sigma |
Suspicious Key Manager Access |
test |
2023-02-09 |
| sigma |
Rundll32 InstallScreenSaver Execution |
test |
2023-02-09 |
| sigma |
Suspicious NTLM Authentication on the Printer Spooler Service |
test |
2023-02-09 |
| sigma |
HackTool - XORDump Execution |
test |
2023-02-08 |
| sigma |
Arbitrary File Download Via MSPUB.EXE |
test |
2023-02-08 |
| sigma |
Suspicious Registry Modification From ADS Via Regini.EXE |
test |
2023-02-08 |
| sigma |
Registry Modification Via Regini.EXE |
test |
2023-02-08 |
| sigma |
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS |
test |
2023-02-08 |
| sigma |
GatherNetworkInfo.VBS Reconnaissance Script Output |
test |
2023-02-08 |
| sigma |
Publisher Attachment File Dropped In Suspicious Location |
test |
2023-02-08 |
| sigma |
Suspicious Outlook Macro Created |
test |
2023-02-08 |
| sigma |
Potential Persistence Via Microsoft Office Add-In |
test |
2023-02-08 |
| sigma |
New Outlook Macro Created |
test |
2023-02-08 |
| sigma |
Folder Removed From Exploit Guard ProtectedFolders List - Registry |
test |
2023-02-08 |
| sigma |
Terminal Server Client Connection History Cleared - Registry |
test |
2023-02-08 |
| sigma |
Potential BlackByte Ransomware Activity |
test |
2023-02-08 |
| sigma |
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS |
test |
2023-02-08 |
| sigma |
WMI Backdoor Exchange Transport Agent |
test |
2023-02-08 |
| sigma |
PUA - Netcat Suspicious Execution |
test |
2023-02-08 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2023-02-07 |
rev 1 |
2023-02-07 |
| snort |
ET TROJAN Win32/Disabler.NPR Checkin |
rev 1 |
2023-02-07 |
| suricata |
ET MALWARE Win32/Disabler.NPR Checkin |
rev 1 |
2023-02-07 |
| suricata |
ET PHISHING Successful Generic Credential Phish 2023-02-07 |
rev 1 |
2023-02-07 |
| sigma |
Suspicious JavaScript Execution Via Mshta.EXE |
test |
2023-02-07 |
| sigma |
Potential LethalHTA Technique Execution |
test |
2023-02-07 |
| sigma |
Potential Persistence Via Disk Cleanup Handler - Registry |
test |
2023-02-07 |
| sigma |
HackTool - Impacket Tools Execution |
test |
2023-02-07 |
| sigma |
PUA - Advanced Port Scanner Execution |
test |
2023-02-07 |
| sigma |
PUA - Advanced IP Scanner Execution |
test |
2023-02-07 |
| sigma |
Potential CVE-2021-26857 Exploitation Attempt |
stable |
2023-02-07 |
| sigma |
Scheduled Task Executed Uncommon LOLBIN |
test |
2023-02-07 |
| sigma |
Scheduled Task Executed From A Suspicious Location |
test |
2023-02-07 |
| sigma |
Renamed AutoHotkey.EXE Execution |
test |
2023-02-07 |
| snort |
ET TROJAN Win32/Comrerop Checkin |
rev 1 |
2023-02-06 |
| snort |
ET INFO Possible SMTP Data Exfiltration - File Attachment Named Files.zip |
rev 1 |
2023-02-06 |
| snort |
ET INFO Ex Libris Library Software DNS Lookup |
rev 1 |
2023-02-06 |
| snort |
ET TROJAN Win32/Spy.Banker.AAGB Checkin |
rev 1 |
2023-02-06 |
| suricata |
ET INFO Ex Libris Library Software DNS Lookup |
rev 1 |
2023-02-06 |
| suricata |
ET INFO Possible SMTP Data Exfiltration - File Attachment Named Files.zip |
rev 1 |
2023-02-06 |