| sigma |
Azure Firewall Rule Configuration Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Keyvault Secrets Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Point-to-site VPN Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure New CloudShell Created |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Events Deleted |
test |
2022-08-23 |
| sigma |
Azure Kubernetes Cluster Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Container Registry Created or Deleted |
test |
2022-08-23 |
| sigma |
Azure Application Security Group Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Application Gateway Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure DNS Zone Modified or Deleted |
test |
2022-08-23 |
| snort |
ET TROJAN Successful CargoBay Exfil |
rev 1 |
2022-08-22 |
| snort |
ET TROJAN Unknown - Loader - Check .exe Updated |
rev 5 |
2022-08-22 |
| snort |
ET INFO Possible Obfuscator io JavaScript Obfuscation Exclusion |
rev 1 |
2022-08-22 |
| suricata |
ET HUNTING Possible Obfuscator io JavaScript Obfuscation Exclusion |
rev 1 |
2022-08-22 |
| sigma |
Reconnaissance Activity |
test |
2022-08-22 |
| sigma |
Persistence Via TypedPaths - CommandLine |
test |
2022-08-22 |
| sigma |
Legitimate Application Dropped Archive |
test |
2022-08-21 |
| sigma |
Disable Powershell Command History |
test |
2022-08-21 |
| sigma |
Execute Code with Pester.bat as Parent |
test |
2022-08-20 |
| snort |
ET TROJAN JSSLoader Initial Checkin |
rev 1 |
2022-08-19 |
| snort |
ET INFO Observed DNS Query to Remote Utilities Domain |
rev 1 |
2022-08-19 |
| suricata |
ET MALWARE Possible WannaCry DNS Lookup 2 |
rev 7 |
2022-08-19 |
| suricata |
ET MALWARE Possible WannaCry DNS Lookup 4 |
rev 7 |
2022-08-19 |
| suricata |
ET INFO Observed DNS Query to Remote Utilities Domain |
rev 1 |
2022-08-19 |
| suricata |
ET MALWARE Possible WannaCry DNS Lookup 3 |
rev 9 |
2022-08-19 |
| suricata |
ET MALWARE Possible WannaCry DNS Lookup 1 |
rev 6 |
2022-08-19 |
| suricata |
ET MALWARE JSSLoader Initial Checkin |
rev 1 |
2022-08-19 |
| suricata |
ET MALWARE Possible WannaCry DNS Lookup 5 |
rev 7 |
2022-08-19 |
| sigma |
Launch-VsDevShell.PS1 Proxy Execution |
test |
2022-08-19 |
| sigma |
Modify Group Policy Settings - ScriptBlockLogging |
test |
2022-08-19 |
| sigma |
CreateDump Process Dump |
test |
2022-08-19 |
| sigma |
DeviceCredentialDeployment Execution |
test |
2022-08-19 |
| sigma |
Modify Group Policy Settings |
test |
2022-08-19 |
| sigma |
REGISTER_APP.VBS Proxy Execution |
test |
2022-08-19 |
| snort |
ET MALWARE CoinSurf Proxy Client Login |
rev 1 |
2022-08-18 |
| snort |
ET CURRENT_EVENTS Successful OWA Phish 2022-08-17 |
rev 1 |
2022-08-18 |
| snort |
ET MALWARE CoinSurf Proxy Client Registration |
rev 1 |
2022-08-18 |
| snort |
ET TROJAN CargoBay User-Agent |
rev 1 |
2022-08-18 |
| suricata |
ET PHISHING Successful OWA Phish 2022-08-17 |
rev 1 |
2022-08-18 |
| suricata |
ET MALWARE CargoBay User-Agent |
rev 1 |
2022-08-18 |