Kostas
2851ef5d16
fix: Potential Privilege Escalation via Local Kerberos Relay over LDAP - Add new exclusion fix: Sdiagnhost Calling Suspicious Child Process - Add new filters new: Antivirus Filter Driver Disallowed On Dev Drive - Registry new: ChromeLoader Malware Execution new: Emotet Loader Execution Via .LNK File new: Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC new: FakeUpdates/SocGholish Activity new: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell new: HackTool - SharpWSUS/WSUSpendu Execution new: HackTool - SOAPHound Execution new: Hiding User Account Via SpecialAccounts Registry Key - CommandLine new: Injected Browser Process Spawning Rundll32 - GuLoader Activity new: Kerberoasting Activity - Initial Query new: Manual Execution of Script Inside of a Compressed File new: Obfuscated PowerShell OneLiner Execution new: OneNote.EXE Execution of Malicious Embedded Scripts new: Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon new: Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 new: Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE new: Python Function Execution Security Warning Disabled In Excel new: Python Function Execution Security Warning Disabled In Excel - Registry new: Raspberry Robin Initial Execution From External Drive new: Raspberry Robin Subsequent Execution of Commands new: Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions new: Remote Access Tool - Ammy Admin Agent Execution new: Remote Access Tool - Cmd.EXE Execution via AnyViewer new: Serpent Backdoor Payload Execution Via Scheduled Task new: Uncommon Connection to Active Directory Web Services new: Ursnif Redirection Of Discovery Commands update: Potential CVE-2022-29072 Exploitation Attempt - Add additional shells and flags --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
TBD