| snort |
ET TROJAN Observed DNS Query to known Avaddon Ransomware Payment Domain |
rev 2 |
2020-06-05 |
| snort |
ET TROJAN Blaze/Supreme Bot Activity M2 |
rev 2 |
2020-06-05 |
| suricata |
ET MALWARE TA410 APT FlowCloud Dependency Download M3 |
rev 2 |
2020-06-05 |
| suricata |
ET MALWARE TA410 APT FlowCloud Dependency Download M1 |
rev 2 |
2020-06-05 |
| suricata |
ET MALWARE TA410 APT FlowCloud Dependency Download M2 |
rev 2 |
2020-06-05 |
| suricata |
ET MALWARE TA410 APT FlowCloud Dependency Download M4 |
rev 2 |
2020-06-05 |
| snort |
ET MALWARE Win32/Adware.Qjwmonkey.H Variant CnC Activity M2 |
rev 2 |
2020-06-04 |
| snort |
ET TROJAN ELF/Kinsing Payload Request M2 |
rev 2 |
2020-06-03 |
| snort |
ET TROJAN ELF/Kinsing Payload Request M1 |
rev 2 |
2020-06-03 |
| snort |
ET EXPLOIT Possible Zephyr RTOS ICMPv4 Stack Buffer Overflow |
rev 2 |
2020-06-02 |
| suricata |
ET EXPLOIT Possible Zephyr RTOS ICMPv4 Stack Buffer Overflow |
rev 1 |
2020-06-02 |
| snort |
ET MALWARE Win32/Adware.Qjwmonkey.H Variant CnC Activity |
rev 3 |
2020-06-01 |
| snort |
ET TROJAN Gamaredon Style MalDoc .dot Download on freedynamicdns .org |
rev 2 |
2020-06-01 |
| snort |
ET TROJAN Higasia CnC Activity |
rev 2 |
2020-06-01 |
| snort |
ET TROJAN TURLA NETFLASH CnC |
rev 2 |
2020-06-01 |
| suricata |
ET MALWARE Higasia CnC Activity |
rev 2 |
2020-06-01 |
| suricata |
ET MALWARE XcodeGhost CnC M2 |
rev 3 |
2020-06-01 |
| suricata |
ET MALWARE Gamaredon Style MalDoc .dot Download on freedynamicdns .org |
rev 1 |
2020-06-01 |
| suricata |
ET MALWARE URI Struct Observed in Pawn Storm CVE-2015-2950 |
rev 3 |
2020-05-29 |
| snort |
ET WEB_SERVER SmailMax PHPMailer Accessed on Internal Server |
rev 2 |
2020-05-28 |
| snort |
ET WEB_CLIENT SmailMax PHPMailer Accessed on External Server |
rev 2 |
2020-05-28 |
| suricata |
ET MALWARE Win32/Keatep.B Checkin |
rev 6 |
2020-05-28 |
| suricata |
ET WEB_SPECIFIC_APPS WEB-PHP RCE PHPBB 2004-1315 |
rev 3 |
2020-05-28 |
| snort |
ET TROJAN Socelars Stealer CnC Activity |
rev 2 |
2020-05-27 |
| snort |
ET TROJAN COMRAT CnC |
rev 2 |
2020-05-27 |
| suricata |
ET MALWARE COMRAT CnC |
rev 1 |
2020-05-27 |
| snort |
ET WEB_CLIENT Generic PHP Uploader Accessed on External Server |
rev 2 |
2020-05-26 |
| snort |
ET POLICY .onion.ly Proxy domain in SNI |
rev 2 |
2020-05-26 |
| snort |
ET TROJAN Possible Konni Encrypted Stage 2 Payload Inbound via HTTP |
rev 2 |
2020-05-26 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Server |
rev 2 |
2020-05-26 |
| snort |
ET TROJAN Konni Stage 2 Payload Exfiltrating Data |
rev 2 |
2020-05-26 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Server |
rev 2 |
2020-05-26 |
| snort |
ET WEB_SERVER Generic PHP Uploader Accessed on Internal Server |
rev 2 |
2020-05-26 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Server |
rev 2 |
2020-05-26 |
| suricata |
ET MALWARE Konni Stage 2 Payload Exfiltrating Data |
rev 1 |
2020-05-26 |
| suricata |
ET WEB_SERVER Generic PHP Uploader Accessed on Internal Server |
rev 1 |
2020-05-26 |
| suricata |
ET WEB_CLIENT Generic PHP Uploader Accessed on External Server |
rev 1 |
2020-05-26 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Server |
rev 2 |
2020-05-26 |
| suricata |
ET ADWARE_PUP Win32/Adware.Qjwmonkey.H Variant CnC Activity |
rev 1 |
2020-05-26 |
| suricata |
ET INFO .onion.ly Proxy domain in SNI |
rev 2 |
2020-05-26 |