| snort |
ET WEB_SERVER Generic Cpanel Cracker Accessed on Internal Compromised Server |
rev 2 |
2020-07-17 |
| suricata |
ET WEB_CLIENT ALFA TEaM Webshell Accessed on External Compromised Server |
rev 3 |
2020-07-17 |
| suricata |
ET MALWARE NEWPASS CnC Client Checkin |
rev 1 |
2020-07-17 |
| suricata |
ET WEB_SERVER Generic Cpanel Cracker Accessed on Internal Compromised Server |
rev 2 |
2020-07-17 |
| suricata |
ET WEB_SERVER ALFA TEaM Webshell Accessed on Internal Compromised Server |
rev 3 |
2020-07-17 |
| suricata |
ET WEB_CLIENT Generic Cpanel Cracker Accessed on External Compromised Server |
rev 2 |
2020-07-17 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Server |
rev 2 |
2020-07-16 |
| snort |
ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server |
rev 2 |
2020-07-16 |
| snort |
ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server |
rev 2 |
2020-07-16 |
| snort |
ET TROJAN APT33/CharmingKitten Shellcode Communicating with CnC |
rev 4 |
2020-07-16 |
| snort |
ET TROJAN BYOB - Python Backdoor Loader Download |
rev 2 |
2020-07-16 |
| snort |
ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server |
rev 2 |
2020-07-16 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Server |
rev 2 |
2020-07-16 |
| snort |
ET USER_AGENTS SAP CVE-2020-6287 PoC UA Observed |
rev 2 |
2020-07-16 |
| snort |
ET TROJAN BYOB - Python Backdoor Stager Download |
rev 2 |
2020-07-16 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Server |
rev 2 |
2020-07-16 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Server |
rev 2 |
2020-07-16 |
| suricata |
ET USER_AGENTS SAP CVE-2020-6287 PoC UA Observed |
rev 1 |
2020-07-16 |
| suricata |
ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server |
rev 2 |
2020-07-16 |
| suricata |
ET MALWARE APT33/CharmingKitten Shellcode Communicating with CnC |
rev 4 |
2020-07-16 |
| suricata |
ET WEB_CLIENT Generic Webshell Password Prompt Accessed on External Compromised Server |
rev 2 |
2020-07-16 |
| suricata |
ET MALWARE BYOB - Python Backdoor Loader Download |
rev 1 |
2020-07-16 |
| suricata |
ET WEB_SERVER Generic Webshell Password Prompt Accessed on Internal Compromised Server |
rev 2 |
2020-07-16 |
| suricata |
ET MALWARE BYOB - Python Backdoor Stager Download |
rev 1 |
2020-07-16 |
| snort |
ET TROJAN EvilNum CnC Client Data Exfil |
rev 2 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Phish to .ga Domain 2018-10-23 |
rev 3 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS HTTP POST Request to Suspicious *.ma Domain |
rev 2 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Phish to .ml Domain 2018-10-23 |
rev 3 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Phish to .gqn Domain 2018-10-23 |
rev 3 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Phish to .ma Domain 2020-07-15 |
rev 2 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Phish to .cf Domain 2018-10-23 |
rev 3 |
2020-07-15 |
| snort |
ET TROJAN EvilNum CnC Error Report |
rev 2 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Phish to .icu Domain 2019-02-06 |
rev 3 |
2020-07-15 |
| snort |
ET TROJAN EvilNum CnC Checkin Response |
rev 2 |
2020-07-15 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Phish to .gq Domain 2018-10-23 |
rev 3 |
2020-07-15 |
| suricata |
ET MALWARE JS/RAA Ransomware check-in |
rev 3 |
2020-07-15 |
| suricata |
ET INFO HTTP POST Request to Suspicious *.ma Domain |
rev 2 |
2020-07-15 |
| suricata |
ET PHISHING Possible Successful Generic Phish to .ma Domain 2020-07-15 |
rev 2 |
2020-07-15 |
| suricata |
ET MALWARE EvilNum CnC Error Report |
rev 1 |
2020-07-15 |
| snort |
ET INFO Possible Malicious Document Request to .tk domain |
rev 2 |
2020-07-14 |