| suricata |
ET INFO Ex Libris Library Software DNS Lookup |
rev 1 |
2023-02-06 |
| suricata |
ET MALWARE Win32/Spy.Banker.AAGB Checkin |
rev 1 |
2023-02-06 |
| sigma |
Suspicious MSHTA Child Process |
test |
2023-02-06 |
| sigma |
Remotely Hosted HTA File Executed Via Mshta.EXE |
test |
2023-02-06 |
| sigma |
Suspicious MSDT Parent Process |
test |
2023-02-06 |
| sigma |
HackTool - Pypykatz Credentials Dumping Activity |
test |
2023-02-05 |
| sigma |
Files Added To An Archive Using Rar.EXE |
test |
2023-02-05 |
| sigma |
Potential Meterpreter/CobaltStrike Activity |
test |
2023-02-05 |
| sigma |
HackTool - PurpleSharp Execution |
test |
2023-02-05 |
| sigma |
Potential Suspicious Registry File Imported Via Reg.EXE |
test |
2023-02-05 |
| sigma |
Potential Raspberry Robin Dot Ending File |
test |
2023-02-05 |
| sigma |
HackTool - Quarks PwDump Execution |
test |
2023-02-05 |
| sigma |
Unusual Child Process of dns.exe |
test |
2023-02-05 |
| sigma |
Potential MSTSC Shadowing Activity |
test |
2023-02-05 |
| sigma |
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE |
test |
2023-02-05 |
| sigma |
DNS Server Error Failed Loading the ServerLevelPluginDLL |
test |
2023-02-05 |
| sigma |
Rhadamanthys Stealer Module Launch Via Rundll32.EXE |
test |
2023-02-05 |
| sigma |
HackTool - PowerTool Execution |
test |
2023-02-04 |
| sigma |
Potentially Over Permissive Permissions Granted Using Dsacls.EXE |
test |
2023-02-04 |
| sigma |
Potential Password Spraying Attempt Using Dsacls.EXE |
test |
2023-02-04 |
| sigma |
SafeBoot Registry Key Deleted Via Reg.EXE |
test |
2023-02-04 |
| sigma |
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE |
test |
2023-02-04 |
| sigma |
Potential Emotet Activity |
stable |
2023-02-04 |
| sigma |
Service Registry Key Deleted Via Reg.EXE |
test |
2023-02-04 |
| sigma |
Suspicious PowerShell Parent Process |
test |
2023-02-04 |
| sigma |
HackTool - Hashcat Password Cracker Execution |
test |
2023-02-04 |
| sigma |
HackTool - Htran/NATBypass Execution |
test |
2023-02-04 |
| sigma |
HackTool - Hydra Password Bruteforce Execution |
test |
2023-02-04 |
| sigma |
HackTool - KrbRelay Execution |
test |
2023-02-04 |
| sigma |
HackTool - KrbRelayUp Execution |
test |
2023-02-04 |
| sigma |
Potential CVE-2021-40444 Exploitation Attempt |
test |
2023-02-04 |
| sigma |
Potential Exploitation Attempt From Office Application |
test |
2023-02-04 |
| sigma |
Potential SystemNightmare Exploitation Attempt |
test |
2023-02-04 |
| sigma |
Potential Persistence Attempt Via Existing Service Tampering |
test |
2023-02-04 |
| sigma |
Scheduled Task Executing Encoded Payload from Registry |
test |
2023-02-04 |
| sigma |
HackTool - ADCSPwn Execution |
test |
2023-02-04 |
| sigma |
HackTool - Bloodhound/Sharphound Execution |
test |
2023-02-04 |
| sigma |
Suspicious Outlook Child Process |
test |
2023-02-04 |
| sigma |
Suspicious Binary In User Directory Spawned From Office Application |
test |
2023-02-04 |
| sigma |
DirLister Execution |
test |
2023-02-04 |