| suricata |
ET HUNTING Suspicious POST with Common Windows Process Names - Possible Process List Exfiltration |
rev 3 |
2020-08-28 |
| suricata |
ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M1 |
rev 3 |
2020-08-28 |
| suricata |
ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt |
rev 3 |
2020-08-28 |
| suricata |
ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern |
rev 5 |
2020-08-28 |
| suricata |
ET PHISHING Fedex Phishing Landing on Appspot Hosting |
rev 2 |
2020-08-28 |
| snort |
ET TROJAN Babax Stealer Exfil via Telegram |
rev 2 |
2020-08-27 |
| snort |
ET TROJAN Win32/AgentTesla Variant Exfil via Telegram |
rev 2 |
2020-08-27 |
| snort |
ET TROJAN GoldenSpy Domain Observed |
rev 2 |
2020-08-27 |
| snort |
ET INFO Suspicious GET To gate.php with no Referer |
rev 2 |
2020-08-27 |
| suricata |
ET MALWARE OSX/Shlayer CnC Activity M1 |
rev 2 |
2020-08-27 |
| suricata |
ET MALWARE OSX/Shlayer CnC Activity M3 |
rev 3 |
2020-08-27 |
| suricata |
ET WEB_SERVER HP Intelligent Management Java Deserialization RCE Attempt |
rev 3 |
2020-08-27 |
| suricata |
ET MALWARE Win32/DanaBot Harvesting Email Addresses 2 |
rev 3 |
2020-08-27 |
| suricata |
ET PHISHING Suspicious SSN Parameter in HTTP POST - Possible Phishing |
rev 2 |
2020-08-27 |
| suricata |
ET MALWARE Win32/AgentTesla Variant Exfil via Telegram |
rev 1 |
2020-08-27 |
| suricata |
ET MALWARE Babax Stealer Exfil via Telegram |
rev 1 |
2020-08-27 |
| suricata |
ET WEB_SERVER jQuery File Upload Attempt |
rev 4 |
2020-08-27 |
| suricata |
ET MALWARE ELF/Win32 Lucky Ransomware CnC Checkin |
rev 3 |
2020-08-27 |
| suricata |
ET WEB_SPECIFIC_APPS WP Cost Estimator Plugin AFI Vulnerability |
rev 3 |
2020-08-27 |
| suricata |
ET MALWARE GoldenSpy Domain Observed |
rev 2 |
2020-08-27 |
| suricata |
ET MALWARE Win32/DanaBot Harvesting Email Addresses 1 |
rev 3 |
2020-08-27 |
| suricata |
ET WEB_SERVER Possible Cookie Based BackDoor Used in Drupal Attacks |
rev 4 |
2020-08-27 |
| suricata |
ET MALWARE Possible APT28 DOC Uploader SSL/TLS Certificate Observed |
rev 3 |
2020-08-27 |
| suricata |
ET MALWARE Vidar/Arkei Stealer Client Data Upload |
rev 5 |
2020-08-27 |
| suricata |
ET P2P Pando Client User-Agent Detected |
rev 8 |
2020-08-27 |
| sigma |
TropicTrooper Campaign November 2018 |
stable |
2020-08-27 |
| snort |
ET TROJAN W32/Downloader_x.EJK!tr CnC Activity |
rev 2 |
2020-08-26 |
| snort |
ET TROJAN Observed Get2 CnC Domain in TLS SNI |
rev 2 |
2020-08-26 |
| snort |
ET POLICY Packity Proxy Connection |
rev 2 |
2020-08-26 |
| snort |
ET TROJAN Grandoreiro Downloader Activity |
rev 2 |
2020-08-26 |
| snort |
ET TROJAN Observed Get2 CnC Domain in TLS SNI |
rev 2 |
2020-08-26 |
| suricata |
ET MALWARE W32/Downloader_x.EJK!tr CnC Activity |
rev 1 |
2020-08-26 |
| suricata |
ET PHISHING Possible Successful Phish - Generic Credential POST to Ngrok.io |
rev 2 |
2020-08-26 |
| suricata |
ET WEB_CLIENT Fake FlashPlayer Update Leading to CoinMiner M1 2018-10-12 |
rev 2 |
2020-08-26 |
| suricata |
ET INFO Observed Packity Proxy Domain in TLS SNI |
rev 2 |
2020-08-26 |
| snort |
ET TROJAN Phorpiex CnC Domain in DNS Query |
rev 2 |
2020-08-25 |
| snort |
ET TROJAN Phorpiex CnC Domain in DNS Query |
rev 2 |
2020-08-25 |
| snort |
ET TROJAN Phorpiex CnC Domain in DNS Query |
rev 2 |
2020-08-25 |
| snort |
ET TROJAN Phorpiex CnC Domain in DNS Query |
rev 2 |
2020-08-25 |
| snort |
ET TROJAN Phorpiex CnC Domain in DNS Query |
rev 2 |
2020-08-25 |