| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.anondns .net Domain |
rev 1 |
2022-08-24 |
| snort |
ET ATTACK_RESPONSE net user Command Output via HTTP POST |
rev 1 |
2022-08-24 |
| suricata |
ET ATTACK_RESPONSE net user Command Output via HTTP POST |
rev 1 |
2022-08-24 |
| sigma |
Bitsadmin to Uncommon IP Server Address |
test |
2022-08-24 |
| snort |
ET INFO SAFIB Assistant Remote Administration Tool Keepalive |
rev 1 |
2022-08-23 |
| suricata |
ET INFO SAFIB Assistant Remote Administration Tool Keepalive |
rev 1 |
2022-08-23 |
| sigma |
Azure Kubernetes Cluster Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure VPN Connection Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Virtual Network Device Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Network Security Configuration Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Point-to-site VPN Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Firewall Rule Configuration Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Keyvault Secrets Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Key Vault Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Container Registry Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Application Security Group Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure DNS Zone Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Secret or Config Object Access |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Service Account Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Firewall Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Application Gateway Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Firewall Rule Collection Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Events Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Network Policy Change |
test |
2022-08-23 |
| sigma |
Azure New CloudShell Created |
test |
2022-08-23 |
| sigma |
Azure Virtual Network Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Network Firewall Policy Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Keyvault Key Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Suppression Rule Created |
test |
2022-08-23 |
| sigma |
Azure Subscription Permission Elevation Via ActivityLogs |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Sensitive Role Access |
test |
2022-08-23 |
| sigma |
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Pods Deleted |
test |
2022-08-23 |
| snort |
ET TROJAN Successful CargoBay Exfil |
rev 1 |
2022-08-22 |
| snort |
ET INFO Possible Obfuscator io JavaScript Obfuscation Exclusion |
rev 1 |
2022-08-22 |
| snort |
ET TROJAN Unknown - Loader - Check .exe Updated |
rev 5 |
2022-08-22 |
| suricata |
ET HUNTING Possible Obfuscator io JavaScript Obfuscation Exclusion |
rev 1 |
2022-08-22 |
| sigma |
Persistence Via TypedPaths - CommandLine |
test |
2022-08-22 |
| sigma |
Reconnaissance Activity |
test |
2022-08-22 |
| sigma |
Disable Powershell Command History |
test |
2022-08-21 |