| suricata |
ET MALWARE Powershell/PowHeartBeat CnC Checkin - ICMP |
rev 1 |
2022-09-13 |
| elastic |
Web Application Suspicious Activity: No User Agent |
deprecated |
2022-09-13 |
| sigma |
Recon Information for Export with Command Prompt |
test |
2022-09-13 |
| sigma |
Taskkill Symantec Endpoint Protection |
test |
2022-09-13 |
| sigma |
Disable-WindowsOptionalFeature Command PowerShell |
test |
2022-09-10 |
| snort |
ET MALWARE Win32/Adware.InstallCommerce.A CnC Checkin |
rev 1 |
2022-09-09 |
| snort |
ET TROJAN Win64/Spy.Agent.EU CnC Checkin |
rev 1 |
2022-09-09 |
| snort |
ET TROJAN Win32/MagicRAT CnC Activity M1 |
rev 2 |
2022-09-09 |
| snort |
ET INFO Go-http-client POSTing IP Address and Username |
rev 1 |
2022-09-09 |
| snort |
ET TROJAN Win32/MagicRAT CnC Activity M2 |
rev 1 |
2022-09-09 |
| suricata |
ET ADWARE_PUP Win32/Adware.InstallCommerce.A CnC Checkin |
rev 1 |
2022-09-09 |
| suricata |
ET MALWARE Win64/Spy.Agent.EU CnC Checkin |
rev 1 |
2022-09-09 |
| sigma |
Delete All Scheduled Tasks |
test |
2022-09-09 |
| sigma |
Suspicious Reg Add BitLocker |
test |
2022-09-09 |
| sigma |
Suspicious Schtasks Schedule Types |
test |
2022-09-09 |
| sigma |
Email Exifiltration Via Powershell |
test |
2022-09-09 |
| sigma |
User Added to Remote Desktop Users Group |
test |
2022-09-09 |
| sigma |
Hermetic Wiper TG Process Patterns |
test |
2022-09-09 |
| snort |
ET TROJAN Win32/Zegost!ml CnC Checkin |
rev 1 |
2022-09-08 |
| snort |
ET CURRENT_EVENTS Successful BECU Phish 2022-09-08 |
rev 1 |
2022-09-08 |
| suricata |
ET PHISHING Successful BECU Phish 2022-09-08 |
rev 1 |
2022-09-08 |
| sigma |
Suspicious Process Parents |
test |
2022-09-08 |
| snort |
ET TROJAN ErbiumStealer Response From Panel |
rev 1 |
2022-09-06 |
| snort |
ET POLICY Suspicious CVV Parameter in HTTP POST - Possible Phishing |
rev 3 |
2022-09-06 |
| snort |
ET TROJAN ErbiumStealer Response From CnC |
rev 1 |
2022-09-06 |
| suricata |
ET MALWARE ErbiumStealer Response From Panel |
rev 1 |
2022-09-06 |
| suricata |
ET MALWARE ErbiumStealer Response From CnC |
rev 1 |
2022-09-06 |
| suricata |
ET PHISHING Suspicious CVV Parameter in HTTP POST - Possible Phishing |
rev 3 |
2022-09-06 |
| sigma |
PowerShell ADRecon Execution |
test |
2022-09-06 |
| snort |
ET TROJAN PureCrypter Requesting Injector M1 |
rev 2 |
2022-09-03 |
| snort |
ET TROJAN PureCrypter Requesting Injector M2 |
rev 2 |
2022-09-03 |
| snort |
ET TROJAN Win32/VictoryGate/Orchard Botnet CnC Checkin |
rev 1 |
2022-09-02 |
| snort |
ET TROJAN Win32/Sabsik.EN.D!ml CnC Checkin |
rev 1 |
2022-09-02 |
| snort |
ET TROJAN Win32/Orchard Botnet Activity |
rev 1 |
2022-09-02 |
| suricata |
ET MALWARE Win32/Sabsik.EN.D!ml CnC Checkin |
rev 1 |
2022-09-02 |
| suricata |
ET MALWARE Win32/Orchard Botnet Activity |
rev 1 |
2022-09-02 |
| suricata |
ET MALWARE Win32/VictoryGate/Orchard Botnet CnC Checkin |
rev 1 |
2022-09-02 |
| sigma |
RDP over Reverse SSH Tunnel WFP |
test |
2022-09-02 |
| snort |
ET TROJAN Win32/Orchard Botnet Activity M2 |
rev 1 |
2022-09-01 |
| snort |
ET MALWARE ZeroTier P2P VPN Activity M1 |
rev 1 |
2022-09-01 |