| suricata |
ET ADWARE_PUP BoostBeast Task Response |
rev 1 |
2023-01-31 |
| suricata |
ET PHISHING Successful VyStar CU Credential Phish 2023-01-31 |
rev 1 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Checkin M2 |
rev 1 |
2023-01-31 |
| suricata |
ET ADWARE_PUP BoostBeast Task Request M2 |
rev 1 |
2023-01-31 |
| sigma |
Unsigned AppX Installation Attempt Using Add-AppxPackage |
test |
2023-01-31 |
| sigma |
Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript |
test |
2023-01-31 |
| sigma |
JXA In-memory Execution Via OSAScript |
test |
2023-01-31 |
| sigma |
OSACompile Run-Only Execution |
test |
2023-01-31 |
| sigma |
Copy Passwd Or Shadow From TMP Path |
test |
2023-01-31 |
| snort |
ET INFO Request for PDF via PowerShell |
rev 1 |
2023-01-30 |
| snort |
ET CURRENT_EVENTS Successful AU myGov Credential Phish 2023-01-30 |
rev 1 |
2023-01-30 |
| suricata |
ET INFO Request for PDF via PowerShell |
rev 1 |
2023-01-30 |
| suricata |
ET PHISHING Successful AU myGov Credential Phish 2023-01-30 |
rev 1 |
2023-01-30 |
| sigma |
Suspicious XOR Encoded PowerShell Command |
test |
2023-01-30 |
| sigma |
PDQ Deploy Remote Adminstartion Tool Execution |
test |
2023-01-30 |
| sigma |
Operator Bloopers Cobalt Strike Commands |
test |
2023-01-30 |
| sigma |
Operator Bloopers Cobalt Strike Modules |
test |
2023-01-30 |
| sigma |
Suspicious Svchost Process Access |
test |
2023-01-30 |
| sigma |
PowerShell Base64 Encoded WMI Classes |
test |
2023-01-30 |
| sigma |
PowerShell Base64 Encoded Reflective Assembly Load |
test |
2023-01-30 |
| sigma |
Powershell Base64 Encoded MpPreference Cmdlet |
test |
2023-01-30 |
| sigma |
New Github Organization Member Added |
test |
2023-01-29 |
| sigma |
Outdated Dependency Or Vulnerability Alert Disabled |
test |
2023-01-27 |
| sigma |
Github Self Hosted Runner Changes Detected |
test |
2023-01-27 |
| sigma |
Potential RDP Tunneling Via Plink |
test |
2023-01-27 |
| snort |
ET INFO Suspected Impacket WMIExec Activity |
rev 1 |
2023-01-26 |
| suricata |
ET INFO Suspected Impacket WMIExec Activity |
rev 1 |
2023-01-26 |
| sigma |
Base64 Encoded PowerShell Command Detected |
test |
2023-01-26 |
| sigma |
Potential BearLPE Exploitation |
test |
2023-01-26 |
| sigma |
Hiding User Account Via SpecialAccounts Registry Key |
test |
2023-01-26 |
| sigma |
Potential Encoded PowerShell Patterns In CommandLine |
test |
2023-01-26 |
| snort |
ET CURRENT_EVENTS Successful Banco G&T Continental Credential Phish 2023-01-25 |
rev 1 |
2023-01-25 |
| suricata |
ET PHISHING Successful Banco G&T Continental Credential Phish 2023-01-25 |
rev 1 |
2023-01-25 |
| sigma |
Potential RDP Tunneling Via SSH |
test |
2023-01-25 |
| sigma |
Potential Suspicious BPF Activity - Linux |
test |
2023-01-25 |
| sigma |
Terminal Service Process Spawn |
test |
2023-01-25 |
| sigma |
Enable BPF Kprobes Tracing |
test |
2023-01-25 |
| snort |
ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M5 |
rev 1 |
2023-01-24 |
| snort |
ET TROJAN Win32/Obsidium Stealer Data Exfiltration Attempt M6 |
rev 1 |
2023-01-24 |
| snort |
ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse |
rev 2 |
2023-01-24 |