| suricata |
ET HUNTING Possible COVID-19 Domain in SSL Certificate M1 |
rev 4 |
2022-12-13 |
| suricata |
ET MALWARE Impersoni-fake-ator backdoor CnC Checkin |
rev 2 |
2022-12-13 |
| sigma |
Run Once Task Execution as Configured in Registry |
test |
2022-12-13 |
| sigma |
Potential DLL Sideloading Via ClassicExplorer32.dll |
test |
2022-12-13 |
| snort |
ET TROJAN Win32/Valyria Maldoc Payload Request M1 |
rev 1 |
2022-12-12 |
| snort |
ET CURRENT_EVENTS ING Banking Credential Phish Landing Page 2022-12-12 |
rev 1 |
2022-12-12 |
| snort |
ET CURRENT_EVENTS Successful PostBank Credential Phish 2022-12-12 |
rev 1 |
2022-12-12 |
| snort |
ET TROJAN Win32/Valyria Maldoc Payload Request M2 |
rev 1 |
2022-12-12 |
| snort |
ET CURRENT_EVENTS Successful ING Banking Credential Phish 2022-12-12 |
rev 1 |
2022-12-12 |
| suricata |
ET PHISHING Successful PostBank Credential Phish 2022-12-12 |
rev 1 |
2022-12-12 |
| snort |
ET TROJAN JS/GootLoader CnC Exfil |
rev 1 |
2022-12-09 |
| sigma |
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded |
test |
2022-12-09 |
| sigma |
Detection of PowerShell Execution via Sqlps.exe |
test |
2022-12-09 |
| sigma |
Potential Credential Dumping Via WER |
test |
2022-12-09 |
| sigma |
ETW Logging Tamper In .NET Processes Via CommandLine |
test |
2022-12-09 |
| sigma |
FoggyWeb Backdoor DLL Loading |
test |
2022-12-09 |
| snort |
ET INFO Onion/TOR Proxy Client Request |
rev 3 |
2022-12-08 |
| snort |
ET TROJAN Win32/Packed.Themida.AAL Checkin |
rev 1 |
2022-12-08 |
| sigma |
LSASS Process Dump Artefact In CrashDumps Folder |
test |
2022-12-08 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-07 |
rev 1 |
2022-12-07 |
| snort |
ET CURRENT_EVENTS Fifth Third Banking Credential Phish Landing Page 2022-12-07 |
rev 1 |
2022-12-07 |
| snort |
ET TROJAN GCleaner Downloader Activity M8 |
rev 1 |
2022-12-07 |
| suricata |
ET MALWARE GCleaner Downloader Activity M8 |
rev 1 |
2022-12-07 |
| suricata |
ET PHISHING Fifth Third Banking Credential Phish Landing Page 2022-12-07 |
rev 1 |
2022-12-07 |
| sigma |
Windows Defender AMSI Trigger Detected |
stable |
2022-12-07 |
| sigma |
Suspicious Scheduled Task Creation |
test |
2022-12-07 |
| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish 2022-12-06 |
rev 1 |
2022-12-06 |
| snort |
ET MALWARE Win32/Adware.Neoreklami.MI Activity M1 |
rev 1 |
2022-12-06 |
| snort |
ET INFO Chrome/0 in User-Agent |
rev 1 |
2022-12-06 |
| snort |
ET CURRENT_EVENTS iCloud Credential Phish Landing Page 2022-12-06 |
rev 1 |
2022-12-06 |
| snort |
ET MALWARE Win32/Adware.Neoreklami.MI Activity M2 |
rev 1 |
2022-12-06 |
| suricata |
ET PHISHING iCloud Credential Phish Landing Page 2022-12-06 |
rev 1 |
2022-12-06 |
| suricata |
ET HUNTING Chrome/0 in User-Agent |
rev 1 |
2022-12-06 |
| sigma |
Registry Persistence Mechanisms in Recycle Bin |
test |
2022-12-06 |
| sigma |
Windows Defender Exclusions Added |
stable |
2022-12-06 |
| sigma |
Windows Defender Exploit Guard Tamper |
test |
2022-12-06 |
| sigma |
Windows Defender Submit Sample Feature Disabled |
stable |
2022-12-06 |
| sigma |
Win Defender Restored Quarantine File |
test |
2022-12-06 |
| sigma |
Microsoft Defender Tamper Protection Trigger |
stable |
2022-12-06 |
| suricata |
ET MALWARE JS.ElectronBot Payload Inbound |
rev 1 |
2022-12-05 |