| suricata |
ET MALWARE METALJACK APT32 CnC Host Checkin |
rev 2 |
2020-04-23 |
| suricata |
ET MALWARE W32/Citadel Conf.bin Download From CnC Server |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell Generic - netsh firewall |
rev 3 |
2020-04-23 |
| suricata |
ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS TinyBrowser tinybrowser.php file Script Execution Attempt |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32/Bilakip.A Downloader Viruslist Download For Populating FakeAV |
rev 3 |
2020-04-23 |
| suricata |
ET MOBILE_MALWARE Android/CoolPaperLeak Sending Information To CnC |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 1 |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER LOIC Javascript DDoS Inbound |
rev 6 |
2020-04-23 |
| suricata |
ET MOBILE_MALWARE Android/Smsilence.A Sending SMS Messages CnC Beacon |
rev 4 |
2020-04-23 |
| suricata |
ET WEB_SERVER Non-Standard HTML page in Joomla /com_content/ dir |
rev 7 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell - MySQL Interface - Server Set Cookie mysql_web_admin*= |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/DownloaderAgent.fajk Successful Infection CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/FloatingCloud.Banker CnC Beacon |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32/Citadel Content.php CnC POST |
rev 3 |
2020-04-23 |
| suricata |
ET SCAN Core-Project Scanning Bot UA Detected |
rev 7 |
2020-04-23 |
| suricata |
ET MALWARE Linux/SSHDoor.A Reporting Backdoor CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Vundo.Downloader Reporting User Website Session Information |
rev 3 |
2020-04-23 |
| suricata |
ET EXPLOIT_KIT DRIVEBY EgyPack Exploit Kit Cookie Present |
rev 5 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 2 |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Trustezeb.C CnC Beacon |
rev 3 |
2020-04-23 |
| snort |
ET MOBILE_MALWARE Suspected PROJECTSPY Cookie |
rev 2 |
2020-04-22 |
| snort |
ET INFO Suspicious NULL DNS Request |
rev 2 |
2020-04-22 |
| suricata |
ET MALWARE W32/Downloader.FakeFlashPlayer Status.Php CnC Beacon |
rev 3 |
2020-04-22 |
| suricata |
ET MALWARE Avzhan DDoS Bot User-Agent MyIE |
rev 8 |
2020-04-22 |
| suricata |
ET INFO GNU/Linux YUM User-Agent Outbound likely related to package management |
rev 4 |
2020-04-22 |
| suricata |
ET WEB_SERVER ColdFusion componentutils access |
rev 7 |
2020-04-22 |
| suricata |
ET EXPLOIT_KIT CritXPack - No Java URI - Dot.class |
rev 3 |
2020-04-22 |
| suricata |
ET EXPLOIT_KIT Sakura exploit kit exploit download request /nano.php |
rev 4 |
2020-04-22 |
| suricata |
ET WEB_SPECIFIC_APPS AWStats Totals sort parameter Remote Code Execution Attempt |
rev 4 |
2020-04-22 |
| suricata |
ET WEB_SPECIFIC_APPS Coppermine Photo Gallery output Parameter Remote Command Execution Attempt |
rev 5 |
2020-04-22 |
| suricata |
ET MALWARE Shylock Module Data POST |
rev 5 |
2020-04-22 |
| suricata |
ET EXPLOIT_KIT Unknown Java Exploit Kit 32-32 byte hex initial landing |
rev 3 |
2020-04-22 |
| suricata |
ET EXPLOIT_KIT RedKit - Potential Payload Requested - /2Digit.html |
rev 3 |
2020-04-22 |
| suricata |
ET MALWARE Request for fake postal receipt from e-mail link |
rev 3 |
2020-04-22 |
| suricata |
ET WEB_SERVER WebShell - JSP File Admin - POST Structure - dir |
rev 4 |
2020-04-22 |
| suricata |
ET WEB_SERVER ColdFusion administrator access |
rev 6 |
2020-04-22 |
| suricata |
ET EXPLOIT_KIT Likely TDS redirecting to exploit kit |
rev 5 |
2020-04-22 |
| suricata |
ET MALWARE Trojan.Win32.Jorik.Totem.vg HTTP request |
rev 3 |
2020-04-22 |
| suricata |
ET WEB_SPECIFIC_APPS Possible JBoss/JMX InvokerServlet Auth Bypass Attempt |
rev 4 |
2020-04-22 |