| snort |
ET INFO DNS Query for Suspicious .cf Domain |
rev 5 |
2022-12-01 |
| snort |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for Product Details Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |
| snort |
ET WEB_SERVER Likely Malicious Request for /proc/self/fd/ |
rev 2 |
2022-12-01 |
| snort |
ET WEB_SERVER Likely Malicious Request for /proc/self/environ |
rev 4 |
2022-12-01 |
| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for Product Details Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |
| suricata |
ET INFO DNS Query for Suspicious .ml Domain |
rev 6 |
2022-12-01 |
| suricata |
ET MALWARE Mustang Panda APT TONESHELL Related Activity |
rev 1 |
2022-12-01 |
| suricata |
ET WEB_SERVER Likely Malicious Request for /proc/self/environ |
rev 7 |
2022-12-01 |
| suricata |
ET MALWARE Possible Heliconia Noise Landing Page Response |
rev 1 |
2022-12-01 |
| suricata |
ET WEB_SERVER Likely Malicious Request for /proc/self/fd/ |
rev 5 |
2022-12-01 |
| suricata |
ET WEB_SERVER Likely Malicious Request for /proc/<pid>/smaps |
rev 1 |
2022-12-01 |
| suricata |
ET INFO HTTP Request to a *.pw domain |
rev 16 |
2022-12-01 |
| suricata |
ET EXPLOIT Xiongmai/HiSilicon DVR - Request for User Details - Possible CVE-2017-7577 Exploit Attempt |
rev 1 |
2022-12-01 |
| suricata |
ET INFO DNS Query for Suspicious .cf Domain |
rev 6 |
2022-12-01 |
| suricata |
ET WEB_SERVER Likely Malicious Request for /proc/<pid>/cmdline |
rev 2 |
2022-12-01 |
| suricata |
ET INFO DNS Query for Suspicious .ga Domain |
rev 6 |
2022-12-01 |
| sigma |
DLL Sideloading Of ShellChromeAPI.DLL |
test |
2022-12-01 |
| sigma |
VMGuestLib DLL Sideload |
test |
2022-12-01 |
| snort |
ET INFO EXE - Served Attached HTTP |
rev 3 |
2022-11-30 |
| snort |
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent |
rev 1 |
2022-11-30 |
| snort |
ET CURRENT_EVENTS Successful Banco de la Repblica Oriental del Uruguay Phish 2022-11-30 |
rev 1 |
2022-11-30 |
| suricata |
ET PHISHING Successful Banco de la Repblica Oriental del Uruguay Phish 2022-11-30 |
rev 1 |
2022-11-30 |
| snort |
ET INFO Microsoft Powershell Banner Output - Decimal Encoded |
rev 1 |
2022-11-29 |
| snort |
ET CURRENT_EVENTS Coinbase Credential Phish Landing Page 2022-11-29 |
rev 1 |
2022-11-29 |
| snort |
ET INFO Microsoft cmd.exe Banner Output - Decimal Encoded |
rev 1 |
2022-11-29 |
| suricata |
ET HUNTING Microsoft cmd.exe Banner Output - Decimal Encoded |
rev 1 |
2022-11-29 |
| suricata |
ET HUNTING Microsoft Powershell Banner Output - Decimal Encoded |
rev 1 |
2022-11-29 |
| suricata |
ET PHISHING Coinbase Credential Phish Landing Page 2022-11-29 |
rev 1 |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Use MSHTA - PowerShell |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Use Rundll32 - PowerShell |
test |
2022-11-29 |
| sigma |
Credential Dumping Tools Service Execution - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Use Rundll32 - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Use MSHTA - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Use Clip - Security |
test |
2022-11-29 |
| sigma |
PowerShell Scripts Installed as Services - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation Via Stdin - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation RUNDLL LAUNCHER - Security |
test |
2022-11-29 |
| sigma |
Invoke-Obfuscation COMPRESS OBFUSCATION - Security |
test |
2022-11-29 |