| sigma |
Potential PowerShell Execution Policy Tampering - ProcCreation |
test |
2023-01-11 |
| snort |
ET TROJAN XDR33 CnC Server SSL Certificate Observed |
rev 1 |
2023-01-10 |
| suricata |
ET MALWARE XDR33 CnC Server SSL Certificate Observed |
rev 1 |
2023-01-10 |
| sigma |
Import PowerShell Modules From Suspicious Directories - ProcCreation |
test |
2023-01-10 |
| sigma |
Import PowerShell Modules From Suspicious Directories |
test |
2023-01-10 |
| sigma |
Suspicious Git Clone |
test |
2023-01-10 |
| snort |
ET TROJAN WinPwn PenTesting Activity |
rev 1 |
2023-01-09 |
| snort |
ET POLICY Http Client Body contains upin= in cleartext |
rev 1 |
2023-01-09 |
| snort |
ET CURRENT_EVENTS Generic Korean Bank Credential Theft 2023-01-09 |
rev 1 |
2023-01-09 |
| sigma |
Potential PowerShell Obfuscation Using Character Join |
test |
2023-01-09 |
| sigma |
Potential DLL Injection Or Execution Using Tracker.exe |
test |
2023-01-09 |
| sigma |
Cisco LDP Authentication Failures |
test |
2023-01-09 |
| snort |
ET TROJAN Redline Stealer TCP CnC Activity |
rev 1 |
2023-01-06 |
| snort |
ET MALWARE Redline Stealer TCP CnC - Id1Response |
rev 1 |
2023-01-06 |
| snort |
ET TROJAN O97M/Sadoca.C!ml Checkin |
rev 1 |
2023-01-06 |
| snort |
ET TROJAN Remote Utility Access Tool Key SMTP Exfil |
rev 1 |
2023-01-06 |
| suricata |
ET MALWARE Redline Stealer TCP CnC - Id1Response |
rev 2 |
2023-01-06 |
| suricata |
ET MALWARE Remote Utility Access Tool Key SMTP Exfil |
rev 1 |
2023-01-06 |
| sigma |
Suspicious Use of /dev/tcp |
test |
2023-01-06 |
| sigma |
VsCode Powershell Profile Modification |
test |
2023-01-06 |
| sigma |
PowerShell SAM Copy |
test |
2023-01-06 |
| snort |
ET TROJAN AHK Bot Domain Profiler CnC Activity |
rev 1 |
2023-01-05 |
| sigma |
PowerShell Get-Process LSASS |
test |
2023-01-05 |
| sigma |
Suspicious Git Clone - Linux |
test |
2023-01-05 |
| sigma |
Net WebClient Casing Anomalies |
test |
2023-01-05 |
| sigma |
Potential RipZip Attack on Startup Folder |
test |
2023-01-05 |
| sigma |
Suspicious PowerShell Encoded Command Patterns |
test |
2023-01-05 |
| sigma |
Suspicious PowerShell Invocations - Specific - ProcessCreation |
test |
2023-01-05 |
| sigma |
Potential Winnti Dropper Activity |
test |
2023-01-05 |
| sigma |
Potential SAM Database Dump |
test |
2023-01-05 |
| sigma |
Suspicious Creation with Colorcpl |
test |
2023-01-05 |
| sigma |
Malicious Base64 Encoded PowerShell Keywords in Command Lines |
test |
2023-01-05 |
| sigma |
Suspicious Execution of Powershell with Base64 |
test |
2023-01-05 |
| sigma |
NTDS.DIT Creation By Uncommon Parent Process |
test |
2023-01-05 |
| sigma |
Suspicious PowerShell Invocation From Script Engines |
test |
2023-01-05 |
| sigma |
Potential Persistence Via Security Descriptors - ScriptBlock |
test |
2023-01-05 |
| snort |
ET TROJAN Win32/Aurora Stealer Sending System Information |
rev 1 |
2023-01-04 |
| suricata |
ET MALWARE Win32/Aurora Stealer Sending System Information |
rev 1 |
2023-01-04 |
| sigma |
Win Susp Computer Name Containing Samtheadmin |
test |
2023-01-04 |
| sigma |
Cisco Collect Data |
test |
2023-01-04 |