| sigma |
Service Installed By Unusual Client - System |
test |
2023-01-04 |
| sigma |
Potential Keylogger Activity |
test |
2023-01-04 |
| sigma |
Space After Filename - macOS |
test |
2023-01-04 |
| sigma |
Cisco Disabling Logging |
test |
2023-01-04 |
| sigma |
Cisco Collect Data |
test |
2023-01-04 |
| sigma |
Cisco Crypto Commands |
test |
2023-01-04 |
| sigma |
Invoke-Obfuscation Via Use MSHTA - PowerShell Module |
test |
2023-01-04 |
| sigma |
Service Installed By Unusual Client - Security |
test |
2023-01-04 |
| sigma |
Win Susp Computer Name Containing Samtheadmin |
test |
2023-01-04 |
| sigma |
PowerShell Get Clipboard |
test |
2023-01-04 |
| sigma |
Cisco Sniffing |
test |
2023-01-04 |
| sigma |
Cisco Show Commands Input |
test |
2023-01-04 |
| sigma |
Cisco File Deletion |
test |
2023-01-04 |
| sigma |
Cisco Discovery |
test |
2023-01-04 |
| sigma |
Cisco Local Accounts |
test |
2023-01-04 |
| sigma |
Cisco Denial of Service |
test |
2023-01-04 |
| sigma |
Cisco Stage Data |
test |
2023-01-04 |
| snort |
ET TROJAN ViperSoftX HTTP CnC Activity |
rev 1 |
2023-01-03 |
| snort |
ET TROJAN linux.backdoor.wordpressexploit file upload test |
rev 1 |
2023-01-03 |
| snort |
ET TROJAN linux.backdoor.wordpressexploit.1 JS backdoor retrieval |
rev 1 |
2023-01-03 |
| snort |
ET TROJAN linux.backdoor.wordpressexploit.2 JS backdoor retrieval |
rev 1 |
2023-01-03 |
| snort |
ET TROJAN linux.backdoor.wordpressexploit.2 CnC Checkin |
rev 1 |
2023-01-03 |
| snort |
ET CURRENT_EVENTS Successful American First CU Credential Phish 2023-01-03 |
rev 1 |
2023-01-03 |
| suricata |
ET MALWARE linux.backdoor.wordpressexploit.1 JS backdoor retrieval |
rev 1 |
2023-01-03 |
| suricata |
ET MALWARE linux.backdoor.wordpressexploit file upload test |
rev 1 |
2023-01-03 |
| suricata |
ET MALWARE linux.backdoor.wordpressexploit.2 CnC Checkin |
rev 1 |
2023-01-03 |
| suricata |
ET MALWARE linux.backdoor.wordpressexploit.2 JS backdoor retrieval |
rev 1 |
2023-01-03 |
| suricata |
ET PHISHING Successful American First CU Credential Phish 2023-01-03 |
rev 1 |
2023-01-03 |
| sigma |
Suspicious PowerShell Invocations - Generic |
test |
2023-01-03 |
| sigma |
Suspicious PowerShell Invocations - Generic - PowerShell Module |
test |
2023-01-03 |
| sigma |
Suspicious PowerShell WindowStyle Option |
test |
2023-01-03 |
| sigma |
Suspicious Rejected SMB Guest Logon From IP |
test |
2023-01-02 |
| sigma |
Suspicious Windows Strings In URI |
test |
2023-01-02 |
| sigma |
Successful IIS Shortname Fuzzing Scan |
test |
2023-01-02 |
| sigma |
Webshell ReGeorg Detection Via Web Logs |
test |
2023-01-02 |
| sigma |
Malicious ShellIntel PowerShell Commandlets |
test |
2023-01-02 |
| sigma |
PowerShell Remote Session Creation |
test |
2023-01-02 |
| sigma |
Oracle WebLogic Exploit CVE-2021-2109 |
test |
2023-01-02 |
| sigma |
Exchange Exploitation CVE-2021-28480 |
test |
2023-01-02 |
| sigma |
Solarwinds SUPERNOVA Webshell Access |
test |
2023-01-02 |