| snort |
ET INFO Base64 Encoded Windows IP Configuration Output in HTTP POST M2 |
rev 1 |
2021-08-16 |
| snort |
ET INFO Base64 Encoded Windows IP Configuration Output in HTTP POST M1 |
rev 1 |
2021-08-16 |
| snort |
ET INFO Base64 Encoded Windows IP Configuration Output in HTTP POST M3 |
rev 1 |
2021-08-16 |
| suricata |
ET HUNTING Base64 Encoded Windows IP Configuration Output in HTTP POST M2 |
rev 1 |
2021-08-16 |
| suricata |
ET HUNTING Base64 Encoded Windows IP Configuration Output in HTTP POST M3 |
rev 1 |
2021-08-16 |
| suricata |
ET HUNTING Base64 Encoded Windows IP Configuration Output in HTTP POST M1 |
rev 1 |
2021-08-16 |
| snort |
ET TROJAN TA455 Related CnC Domain in DNS Lookup |
rev 2 |
2021-08-13 |
| snort |
ET TROJAN TA455 Related CnC Domain in DNS Lookup |
rev 2 |
2021-08-13 |
| snort |
ET TROJAN TA455 Related CnC Domain in DNS Lookup |
rev 2 |
2021-08-13 |
| snort |
ET TROJAN Unknown Chinese Threat Actor CnC Domain in DNS Lookup |
rev 1 |
2021-08-13 |
| snort |
ET TROJAN TA455 Related CnC Domain in DNS Lookup |
rev 2 |
2021-08-13 |
| snort |
ET TROJAN Win32/PSW.Agent.OMP Variant CnC Activity |
rev 1 |
2021-08-13 |
| snort |
ET TROJAN MSIL/Black Hat Worm Server Response |
rev 1 |
2021-08-12 |
| suricata |
ET MALWARE MSIL/Black Hat Worm Server Response |
rev 1 |
2021-08-12 |
| snort |
ET TROJAN IIStealer Inbound Exfil Request M2 |
rev 1 |
2021-08-11 |
| snort |
ET TROJAN IIStealer Inbound Exfil Request |
rev 1 |
2021-08-11 |
| snort |
ET TROJAN Win32/DownloadAdmin Activity |
rev 2 |
2021-08-11 |
| suricata |
ET MALWARE Win32/DownloadAdmin Activity |
rev 1 |
2021-08-11 |
| snort |
ET TROJAN Suspected TeamTNT Linux Miner Activity |
rev 1 |
2021-08-10 |
| snort |
ET TROJAN Suspected Malicious VBS Script Activity |
rev 2 |
2021-08-10 |
| snort |
ET INFO Possible Sharepoint Resource Infection |
rev 1 |
2021-08-10 |
| snort |
ET CURRENT_EVENTS Observed Zimbra Phishing Landing Page 2021-08-09 |
rev 1 |
2021-08-09 |
| snort |
ET CURRENT_EVENTS Observed OneDrive Phishing Landing Page 2021-08-09 |
rev 1 |
2021-08-09 |
| sigma |
Ursnif Malware C2 URL Pattern |
stable |
2021-08-09 |
| sigma |
Conti Volume Shadow Listing |
test |
2021-08-09 |
| snort |
ET TROJAN ELF/Roboto - Possible Encrypted Roboto P2P Payload Requested M1 |
rev 4 |
2021-08-06 |
| suricata |
ET PHISHING Request for Possible Microsoft Phishing Hosted on Github.io |
rev 5 |
2021-08-06 |
| snort |
ET MOBILE_MALWARE Oscorp/UBEL Activity |
rev 2 |
2021-08-05 |
| snort |
ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M2 |
rev 3 |
2021-08-05 |
| snort |
ET TROJAN Maldoc CnC Domain in DNS Lookup |
rev 1 |
2021-08-04 |
| snort |
ET USER_AGENTS sysWeb User-Agent |
rev 1 |
2021-08-04 |
| snort |
ET TROJAN Thallium CnC Domain in DNS Lookup |
rev 2 |
2021-08-04 |
| suricata |
ET USER_AGENTS sysWeb User-Agent |
rev 1 |
2021-08-04 |
| snort |
ET TROJAN SSV Agent CnC Activity |
rev 2 |
2021-08-03 |
| suricata |
ET MALWARE SSV Agent CnC Activity |
rev 2 |
2021-08-03 |
| snort |
ET TROJAN TA421/YTTRIUM/APT29 TLS Certificate M1 |
rev 2 |
2021-08-02 |
| snort |
ET EXPLOIT phpMyAdmin setup.php Local File Include |
rev 1 |
2021-08-02 |
| snort |
ET TROJAN BlackMatter CnC Activity |
rev 2 |
2021-08-02 |
| snort |
ET TROJAN Jupyter Stealer Reporting System Information M2 |
rev 1 |
2021-08-02 |
| suricata |
ET EXPLOIT phpMyAdmin setup.php Local File Include |
rev 1 |
2021-08-02 |