| snort |
ET WEB_CLIENT Generic Mailer Check Accessed on External Server |
rev 3 |
2020-07-27 |
| suricata |
ET MALWARE Possible Pegasus/Trident Related HTTP Beacon 1 |
rev 4 |
2020-07-27 |
| suricata |
ET MALWARE Possible Pegasus/Trident Related HTTP Beacon 2 |
rev 3 |
2020-07-27 |
| suricata |
ET MALWARE Possible Pegasus/Trident Related HTTP Beacon 4 |
rev 4 |
2020-07-27 |
| snort |
ET WEB_CLIENT Generic Website Ransomnote Accessed on External Compromised Server |
rev 2 |
2020-07-24 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Server |
rev 2 |
2020-07-24 |
| snort |
ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server |
rev 2 |
2020-07-24 |
| snort |
ET WEB_SERVER Generic Website Ransomnote Accessed on Internal Compromised Server |
rev 2 |
2020-07-24 |
| snort |
ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server |
rev 2 |
2020-07-24 |
| snort |
ET INFO Generic 302 Redirect to Google |
rev 2 |
2020-07-24 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Server |
rev 2 |
2020-07-24 |
| snort |
ET CURRENT_EVENTS Successful Generic Redeye Phish 2020-07-24 |
rev 2 |
2020-07-24 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Server |
rev 2 |
2020-07-24 |
| suricata |
ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server |
rev 2 |
2020-07-24 |
| suricata |
ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server |
rev 2 |
2020-07-24 |
| suricata |
ET WEB_CLIENT Generic Website Ransomnote Accessed on External Compromised Server |
rev 2 |
2020-07-24 |
| suricata |
ET WEB_SERVER Generic Website Ransomnote Accessed on Internal Compromised Server |
rev 2 |
2020-07-24 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Server |
rev 2 |
2020-07-24 |
| snort |
ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Probe |
rev 2 |
2020-07-22 |
| snort |
ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Exploit Success |
rev 2 |
2020-07-22 |
| snort |
ET TROJAN Win32/Fujacks Variant CnC Activity |
rev 2 |
2020-07-22 |
| snort |
ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Vulnerable Response |
rev 2 |
2020-07-22 |
| snort |
ET EXPLOIT Possible SAP NetWeaver CVE-2020-6287 Exploit Attempt |
rev 2 |
2020-07-22 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-21 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-20 |
| snort |
ET TROJAN Project Plague CnC Activity |
rev 2 |
2020-07-20 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-20 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-20 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-07-20 |
| snort |
ET WEB_CLIENT ALFA TEaM Webshell Accessed on External Compromised Server |
rev 3 |
2020-07-17 |
| snort |
ET TROJAN NEWPASS CnC Client Checkin |
rev 2 |
2020-07-17 |
| snort |
ET WEB_SERVER Generic Cpanel Cracker Accessed on Internal Compromised Server |
rev 2 |
2020-07-17 |
| snort |
ET WEB_CLIENT Generic Cpanel Cracker Accessed on External Compromised Server |
rev 2 |
2020-07-17 |