| sigma |
HackTool - Bloodhound/Sharphound Execution |
test |
2023-02-04 |
| sigma |
Potential DLL Sideloading Via DeviceEnroller.EXE |
test |
2023-02-04 |
| sigma |
Service Registry Key Deleted Via Reg.EXE |
test |
2023-02-04 |
| sigma |
HackTool - PowerTool Execution |
test |
2023-02-04 |
| sigma |
Suspicious Outlook Child Process |
test |
2023-02-04 |
| sigma |
HackTool - KrbRelayUp Execution |
test |
2023-02-04 |
| sigma |
HackTool - KrbRelay Execution |
test |
2023-02-04 |
| sigma |
DirLister Execution |
test |
2023-02-04 |
| sigma |
Potential Persistence Attempt Via Existing Service Tampering |
test |
2023-02-04 |
| sigma |
Suspicious Microsoft Office Child Process - MacOS |
test |
2023-02-04 |
| snort |
ET CURRENT_EVENTS Successful Wallet Connect Key Store Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| snort |
ET CURRENT_EVENTS Successful Wallet Connect Pass Phrase Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| snort |
ET CURRENT_EVENTS Successful Wallet Connect Private Key Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| snort |
ET TROJAN Win32/Lumma Stealer Data Exfiltration Attempt M2 |
rev 2 |
2023-02-03 |
| suricata |
ET PHISHING Successful Wallet Connect Private Key Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| suricata |
ET PHISHING Successful Wallet Connect Key Store Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| suricata |
ET PHISHING Successful Wallet Connect Pass Phrase Phish 2023-02-03 |
rev 1 |
2023-02-03 |
| sigma |
Potential QBot Activity |
stable |
2023-02-03 |
| sigma |
Potential PlugX Activity |
test |
2023-02-03 |
| sigma |
Renamed FTP.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed Jusched.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed Mavinject.EXE Execution |
test |
2023-02-03 |
| sigma |
Renamed MegaSync Execution |
test |
2023-02-03 |
| sigma |
Renamed Msdt.EXE Execution |
test |
2023-02-03 |
| sigma |
Nltest.EXE Execution |
test |
2023-02-03 |
| sigma |
Potential AMSI Bypass Via .NET Reflection |
test |
2023-02-03 |
| sigma |
Potential Ryuk Ransomware Activity |
stable |
2023-02-03 |
| sigma |
Potential Dridex Activity |
stable |
2023-02-03 |
| sigma |
Renamed Plink Execution |
test |
2023-02-03 |
| sigma |
Potential Renamed Rundll32 Execution |
test |
2023-02-03 |
| sigma |
Potential Persistence Via Powershell Search Order Hijacking - Task |
test |
2023-02-03 |
| sigma |
Renamed Remote Utilities RAT (RURAT) Execution |
test |
2023-02-03 |
| sigma |
LockerGoga Ransomware Activity |
stable |
2023-02-03 |
| sigma |
Potential Process Injection Via Msra.EXE |
test |
2023-02-03 |
| sigma |
Potential CVE-2022-26809 Exploitation Attempt |
test |
2023-02-03 |
| sigma |
Renamed Vmnat.exe Execution |
test |
2023-02-03 |
| sigma |
Potential Arbitrary Code Execution Via Node.EXE |
test |
2023-02-03 |
| sigma |
Potential Manage-bde.wsf Abuse To Proxy Execution |
test |
2023-02-03 |
| sigma |
Microsoft Workflow Compiler Execution |
test |
2023-02-03 |
| sigma |
Renamed BrowserCore.EXE Execution |
test |
2023-02-03 |