| sigma |
Potential Arbitrary Code Execution Via Node.EXE |
test |
2023-02-03 |
| snort |
ET INFO RustDesk Register Peer where serial=1 |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN UAC-0114/Winter Vivern File Exfilration |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Register Peer where serial=0 |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN UAC-0114/Winter Vivern Screenshot Upload M1 |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN UAC-0114/Winter Vivern CnC Activity |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Get Software Update URL |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Check NAT Type |
rev 1 |
2023-02-02 |
| snort |
ET INFO RustDesk Register Public Key |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN Kakfum/COLDSTEEL CnC Beacon M3 |
rev 1 |
2023-02-02 |
| snort |
ET TROJAN UAC-0114/Winter Vivern Screenshot Upload M2 |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Relay Domain in DNS Lookup |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE Kakfum/COLDSTEEL CnC Beacon M3 |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Get Software Update URL |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE UAC-0114/Winter Vivern Screenshot Upload M2 |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE UAC-0114/Winter Vivern CnC Activity |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Check NAT Type |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Register Peer where serial=0 |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Register Public Key |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
rev 1 |
2023-02-02 |
| suricata |
ET INFO RustDesk Register Peer where serial=1 |
rev 1 |
2023-02-02 |
| suricata |
ET MALWARE UAC-0114/Winter Vivern File Exfilration |
rev 1 |
2023-02-02 |
| sigma |
OneNote.EXE Execution of Malicious Embedded Scripts |
test |
2023-02-02 |
| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - CLI |
test |
2023-02-02 |
| sigma |
Domain Trust Discovery Via Dsquery |
test |
2023-02-02 |
| snort |
ET CURRENT_EVENTS Successful Metamask Pass Phrase Phish 2023-02-01 |
rev 1 |
2023-02-01 |
| suricata |
ET PHISHING Successful Metamask Pass Phrase Phish 2023-02-01 |
rev 1 |
2023-02-01 |
| sigma |
ConvertTo-SecureString Cmdlet Usage Via CommandLine |
test |
2023-02-01 |
| sigma |
Java Running with Remote Debugging |
test |
2023-02-01 |
| snort |
ET CURRENT_EVENTS Successful VyStar CU Credential Phish 2023-01-31 |
rev 1 |
2023-01-31 |
| snort |
ET TROJAN DeimosC2 TCP Agent Heartbeat |
rev 2 |
2023-01-31 |
| snort |
ET TROJAN GCleaner Downloader - Payload Response |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Task Request M2 |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Task Response |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Checkin M2 |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Checkin M1 |
rev 1 |
2023-01-31 |
| snort |
ET MALWARE BoostBeast Task Request M1 |
rev 1 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Task Request M1 |
rev 1 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Task Response |
rev 1 |
2023-01-31 |