Rule Library
Sigma Rules
2 rules found for "@sam0x90"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
ISO File Created Within Temp Folders
Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.
WindowsFile Event
@sam0x90Sat Jul 30windows
Detectionmediumtest
Esentutl Gather Credentials
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
WindowsProcess Creation
sam0x90Fri Aug 06windows