| sigma |
Atbroker Registry Change |
test |
2023-01-19 |
| sigma |
SQLite Chromium Profile Data DB Access |
test |
2023-01-19 |
| sigma |
SQLite Firefox Profile Data DB Access |
test |
2023-01-19 |
| sigma |
Query Usage To Exfil Data |
test |
2023-01-19 |
| sigma |
Powershell XML Execute Command |
test |
2023-01-19 |
| snort |
ET INFO Observed Nighthawk 404 Server Response |
rev 1 |
2023-01-18 |
| snort |
ET TROJAN Magecart Skimmer CSS |
rev 2 |
2023-01-18 |
| suricata |
ET MALWARE Magecart Skimmer CSS |
rev 2 |
2023-01-18 |
| sigma |
Flush Iptables Ufw Chain |
test |
2023-01-18 |
| snort |
ET TROJAN Magecart Loader Javascript |
rev 1 |
2023-01-17 |
| snort |
ET INFO DDoS-Guard Hosted Content |
rev 1 |
2023-01-17 |
| snort |
ET TROJAN Andariel Elf Backdoor Activity |
rev 1 |
2023-01-17 |
| suricata |
ET MALWARE Andariel Elf Backdoor Activity |
rev 1 |
2023-01-17 |
| sigma |
The Windows Defender Firewall Service Failed To Load Group Policy |
test |
2023-01-17 |
| snort |
ET INFO OneNote Notebook Downloaded via Powershell |
rev 2 |
2023-01-16 |
| sigma |
Potential Data Exfiltration Via Audio File |
test |
2023-01-16 |
| sigma |
DNS Query for Anonfiles.com Domain - Sysmon |
test |
2023-01-16 |
| sigma |
Suspicious Cobalt Strike DNS Beaconing - Sysmon |
test |
2023-01-16 |
| sigma |
DNS HybridConnectionManager Service Bus |
test |
2023-01-16 |
| sigma |
Malicious Nishang PowerShell Commandlets |
test |
2023-01-16 |
| sigma |
Suspicious Digital Signature Of AppX Package |
test |
2023-01-16 |
| sigma |
DNS Query for Anonfiles.com Domain - DNS Client |
test |
2023-01-16 |
| sigma |
Suspicious Cobalt Strike DNS Beaconing - DNS Client |
test |
2023-01-16 |
| sigma |
DNS Query To MEGA Hosting Website - DNS Client |
test |
2023-01-16 |
| sigma |
Root Certificate Installed From Susp Locations |
test |
2023-01-16 |
| snort |
ET TROJAN Win32/Spy.KeyLogger.RJA Checkin |
rev 1 |
2023-01-13 |
| snort |
ET TROJAN Win32/Gamaredon CnC Activity |
rev 1 |
2023-01-13 |
| suricata |
ET MALWARE Win32/Spy.KeyLogger.RJA Checkin |
rev 1 |
2023-01-13 |
| snort |
ET TROJAN DCRAT Checkin via Telegram |
rev 1 |
2023-01-12 |
| sigma |
Mount Execution With Hidepid Parameter |
test |
2023-01-12 |
| sigma |
Restricted Software Access By SRP |
test |
2023-01-12 |
| sigma |
Potential Malicious AppX Package Installation Attempts |
test |
2023-01-12 |
| snort |
ET CURRENT_EVENTS Manhattan College Phish Landing Page 2022-01-10 |
rev 1 |
2023-01-11 |
| snort |
ET CURRENT_EVENTS Successful Manhattan College Credential Phish 2022-01-10 |
rev 1 |
2023-01-11 |
| snort |
ET TROJAN Win32/Nitol.A CnC Checkin M3 |
rev 1 |
2023-01-11 |
| sigma |
Deployment Of The AppX Package Was Blocked By The Policy |
test |
2023-01-11 |
| sigma |
Touch Suspicious Service File |
test |
2023-01-11 |
| sigma |
AppX Located in Known Staging Directory Added to Deployment Pipeline |
test |
2023-01-11 |
| sigma |
Deployment AppX Package Was Blocked By AppLocker |
test |
2023-01-11 |
| sigma |
Potential PowerShell Execution Policy Tampering - ProcCreation |
test |
2023-01-11 |