| suricata |
ET WEB_SPECIFIC_APPS ManageEngine Desktop Central Administrator Account Creation |
rev 3 |
2020-05-14 |
| snort |
ET TROJAN BACKCONFIG CnC Downloader Activity |
rev 2 |
2020-05-13 |
| snort |
ET MALWARE Crackswin Downloader Activity |
rev 2 |
2020-05-13 |
| suricata |
ET MALWARE OSX/WireLurker checkin |
rev 3 |
2020-05-13 |
| suricata |
ET MALWARE OSX/WireLurker HTTP Request for www.comeinbaby.com |
rev 4 |
2020-05-13 |
| suricata |
ET MALWARE Possible Asprox Pizza |
rev 3 |
2020-05-13 |
| suricata |
ET WEB_SERVER Possible CVE-2014-3120 Elastic Search Remote Code Execution Attempt |
rev 4 |
2020-05-13 |
| suricata |
ET MALWARE W32/AntiBreach Possible Activation Attempt |
rev 3 |
2020-05-13 |
| suricata |
ET ADWARE_PUP Crackswin Downloader Activity |
rev 2 |
2020-05-13 |
| suricata |
ET MALWARE OSX/WireLurker HTTP Request for manhuaba.com.cn |
rev 4 |
2020-05-13 |
| suricata |
ET MALWARE DEEP PANDA Checkin 3 |
rev 5 |
2020-05-13 |
| suricata |
ET EXPLOIT_KIT Fiesta SilverLight 5.x Exploit URI Struct |
rev 3 |
2020-05-13 |
| suricata |
ET EXPLOIT_KIT Fiesta Flash Exploit URI Struct |
rev 8 |
2020-05-13 |
| snort |
ET TROJAN Hakbit/Thanos Ransomware Exfil via FTP |
rev 2 |
2020-05-12 |
| snort |
ET TROJAN Observed TrojanSpy.SH.HADGLIDER.A Exfil Domain in DNS Query |
rev 2 |
2020-05-12 |
| suricata |
ET MALWARE Hakbit/Thanos Ransomware Exfil via FTP |
rev 1 |
2020-05-12 |
| suricata |
ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Cookie |
rev 5 |
2020-05-12 |
| snort |
ET TROJAN PowerShell Downloader CnC Activity |
rev 2 |
2020-05-11 |
| snort |
ET TROJAN Unk.VBSLoader Retrieving Payload |
rev 2 |
2020-05-11 |
| snort |
ET USER_AGENTS Possible QBot User-Agent |
rev 2 |
2020-05-11 |
| snort |
ET CURRENT_EVENTS IRS COVID-19 Landing Page |
rev 2 |
2020-05-11 |
| snort |
ET CURRENT_EVENTS NHS Gov UK COVID-19 Landing Page |
rev 2 |
2020-05-11 |
| suricata |
ET USER_AGENTS Possible QBot User-Agent |
rev 1 |
2020-05-11 |
| snort |
ET POLICY ipchicken .com DNS Lookup |
rev 2 |
2020-05-08 |
| snort |
ET POLICY External Oracle T3 Requests Inbound |
rev 2 |
2020-05-08 |
| snort |
ET TROJAN MAZE Ransomware Payment Domain in DNS Lookup |
rev 2 |
2020-05-08 |
| snort |
ET EXPLOIT Possible Oracle WebLogic CVE-2020-2551 Scanning |
rev 2 |
2020-05-08 |
| snort |
ET TROJAN MAZE Ransomware Payment Domain DNS Lookup |
rev 2 |
2020-05-08 |
| suricata |
ET EXPLOIT Possible Oracle WebLogic CVE-2020-2551 Scanning |
rev 1 |
2020-05-08 |
| suricata |
ET WEB_CLIENT Likely MS12-004 midiOutPlayNextPolyEvent Heap Overflow Midi Filename Requested baby.mid |
rev 4 |
2020-05-08 |
| suricata |
ET MALWARE Zbot UA |
rev 6 |
2020-05-08 |
| suricata |
ET MALWARE Urlzone/Bebloh/Bublik Checkin /was/vas.php |
rev 6 |
2020-05-08 |
| suricata |
ET WEB_SERVER Joomla Component SQLi Attempt |
rev 4 |
2020-05-08 |
| suricata |
ET INFO External Oracle T3 Requests Inbound |
rev 2 |
2020-05-08 |
| suricata |
ET MALWARE W32/Tobfy.Ransomware CnC Request - status.php |
rev 5 |
2020-05-08 |
| suricata |
ET MALWARE Georgian Targeted Attack - Trojan Checkin |
rev 4 |
2020-05-08 |
| suricata |
ET MALWARE W32/Tobfy.Ransomware Invalid URI CnC Request |
rev 5 |
2020-05-08 |
| snort |
ET TROJAN EVILNUM CnC Connectivity Check |
rev 2 |
2020-05-07 |
| snort |
ET POLICY moanmyip .com DNS Lookup |
rev 2 |
2020-05-07 |
| snort |
ET TROJAN EVILNUM CnC Host Checkin |
rev 2 |
2020-05-07 |