| suricata |
ET WEB_SERVER ColdFusion scheduleedit access |
rev 3 |
2020-04-24 |
| suricata |
ET WEB_SERVER ColdFusion password.properties access |
rev 4 |
2020-04-24 |
| suricata |
ET EXPLOIT_KIT Watering Hole applet name AppletHigh.jar |
rev 5 |
2020-04-24 |
| suricata |
ET MALWARE Suspicious User-Agent MyAgrent |
rev 4 |
2020-04-24 |
| suricata |
ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server |
rev 1 |
2020-04-24 |
| suricata |
ET EXPLOIT_KIT Unknown Malvertising Exploit Kit Hostile Jar app.jar |
rev 5 |
2020-04-24 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Compromised Internal Server |
rev 2 |
2020-04-24 |
| suricata |
ET MALWARE Koobface C&C availability check |
rev 9 |
2020-04-24 |
| suricata |
ET WEB_SERVER WebShell Generic - ELF File Uploaded |
rev 3 |
2020-04-24 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on Compromised External Server |
rev 2 |
2020-04-24 |
| suricata |
ET INFO Serialized Data request |
rev 5 |
2020-04-24 |
| suricata |
ET WEB_SERVER ColdFusion scheduletasks access |
rev 3 |
2020-04-24 |
| suricata |
ET WEB_SERVER WebShell - GODSpy - Cookie |
rev 3 |
2020-04-24 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on Compromised External Server |
rev 2 |
2020-04-24 |
| suricata |
ET WEB_SERVER WebShell - GODSPy - Auth Creds |
rev 3 |
2020-04-24 |
| snort |
ET TROJAN METALJACK APT32 CnC Host Checkin |
rev 2 |
2020-04-23 |
| snort |
ET MALWARE Observed DNS Query to Malvertising Related Domain |
rev 2 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 2 |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE Linux/SSHDoor.A Reporting Backdoor CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Vundo.Downloader Reporting User Website Session Information |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Trustezeb.C CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET SCAN Core-Project Scanning Bot UA Detected |
rev 7 |
2020-04-23 |
| suricata |
ET MALWARE W32/DownloaderAgent.fajk Successful Infection CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER Non-Standard HTML page in Joomla /com_content/ dir |
rev 7 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell - PHPShell - Haxplorer URI |
rev 3 |
2020-04-23 |
| suricata |
ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS TinyBrowser edit.php file Script Execution Attempt |
rev 3 |
2020-04-23 |
| suricata |
ET EXPLOIT_KIT TDS - in.php |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell Generic - wget http - POST |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Citadel Pro File.php CnC POST |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell - MySQL Interface - Client Cookie mysql_web_admin*= |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32/Bilakip.A Downloader API Ping CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET INFO Generic HTTP EXE Upload Outbound |
rev 3 |
2020-04-23 |
| suricata |
ET MOBILE_MALWARE Android/Smsilence.A Successful Install Report |
rev 4 |
2020-04-23 |
| suricata |
ET EXPLOIT_KIT Gondad Exploit Kit Post Exploitation Request |
rev 3 |
2020-04-23 |
| suricata |
ET EXPLOIT_KIT DRIVEBY EgyPack Exploit Kit Cookie Present |
rev 5 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 1 |
rev 3 |
2020-04-23 |
| suricata |
ET MOBILE_MALWARE Android/Smsilence.A Sending SMS Messages CnC Beacon |
rev 4 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS TinyBrowser upload.php file Script Execution Attempt |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/StartPage.eba Dropper Checkin |
rev 4 |
2020-04-23 |