| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 |
test |
2022-12-05 |
| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 |
test |
2022-12-05 |
| sigma |
Mavinject Inject DLL Into Running Process |
test |
2022-12-05 |
| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 |
test |
2022-12-05 |
| sigma |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 |
test |
2022-12-05 |
| sigma |
Suspicious Scheduled Task Update |
test |
2022-12-05 |
| snort |
ET TROJAN Possible Heliconia Noise Landing Page Response |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - RTSP Buffer Overflow Attempt - CVE-2022-26259 |
rev 1 |
2022-12-02 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Telnet Opening - Successful CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - OpenTelnet Inbound - Possilbe CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| snort |
ET CURRENT_EVENTS Coinbase Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| snort |
ET CURRENT_EVENTS ING Group Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Auth - Possilbe CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Telnet Opening - Successful CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING Coinbase Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| suricata |
ET PHISHING ING Group Credential Phish Landing Page 2022-12-02 |
rev 1 |
2022-12-02 |
| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Successful Auth - Possilbe CVE-2020-22253 Attempt |
rev 1 |
2022-12-02 |
| sigma |
Detected Windows Software Discovery - PowerShell |
test |
2022-12-02 |
| sigma |
Suspicious PowerShell Download - Powershell Script |
test |
2022-12-02 |
| sigma |
Wmiprvse Wbemcomn DLL Hijack - File |
test |
2022-12-02 |
| sigma |
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script |
test |
2022-12-02 |
| sigma |
Suspicious Get Information for SMB Share - PowerShell Module |
test |
2022-12-02 |
| sigma |
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module |
test |
2022-12-02 |
| sigma |
Clear PowerShell History - PowerShell |
test |
2022-12-02 |
| sigma |
Adwind RAT / JRAT File Artifact |
test |
2022-12-02 |
| sigma |
Root Certificate Installed - PowerShell |
test |
2022-12-02 |
| sigma |
Use Get-NetTCPConnection - PowerShell Module |
test |
2022-12-02 |
| sigma |
Clear PowerShell History - PowerShell Module |
test |
2022-12-02 |
| sigma |
Time Travel Debugging Utility Usage - Image |
test |
2022-12-02 |
| snort |
ET INFO DNS Query for Suspicious .ga Domain |
rev 5 |
2022-12-01 |
| snort |
ET WEB_SERVER Likely Malicious Request for /proc/<pid>/cmdline |
rev 2 |
2022-12-01 |
| snort |
ET INFO DNS Query for Suspicious .ml Domain |
rev 5 |
2022-12-01 |
| snort |
ET TROJAN Mustang Panda APT TONESHELL Related Activity |
rev 1 |
2022-12-01 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for User Details - Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |
| snort |
ET INFO Microsoft Connection Test |
rev 5 |
2022-12-01 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for Product Details Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |