| suricata |
ET ATTACK_RESPONSE SysInternals sc.exe Output Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x02 |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC portmap nisd request UDP |
rev 10 |
2019-07-26 |
| suricata |
ET EXPLOIT php script base64 encoded Remote Code Execution 3 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Outgoing Chromoting Session Response |
rev 3 |
2019-07-26 |
| suricata |
ET P2P eMule KAD Network Server Status Request |
rev 4 |
2019-07-26 |
| suricata |
ET INFO Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE x0Proto Client Info |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible Malicious NAT-PMP Response to External Network |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Remcos RAT Checkin 71 |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC Scanning Message |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT ETERNALBLUE Exploit M2 MS17-010 |
rev 2 |
2019-07-26 |
| suricata |
GPL TFTP GET Admin.dll |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS RemoteActivation attempt |
rev 4 |
2019-07-26 |
| suricata |
ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection |
rev 15 |
2019-07-26 |
| suricata |
ET INFO Cryptocurrency Miner Checkin M2 |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC RQUOTA getquota overflow attempt UDP |
rev 10 |
2019-07-26 |
| suricata |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attack Done Message |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE MAGICHOUND.LEASH IRC CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE SMTP Subject Line Contains C Path and EXE Possible Trojan Reporting Execution Path/Binary Name |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN Potential SSH Scan OUTBOUND |
rev 7 |
2019-07-26 |
| suricata |
ET EXPLOIT Cisco Smart Install Exploitation Tool - Update Ios and Execute |
rev 1 |
2019-07-26 |
| suricata |
GPL DNS named iquery attempt |
rev 9 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS Yahoo CD Player ActiveX Open Stack Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Windows driverquery -si Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Gh0st Trojan CnC 3 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO SMB2 NT Create AndX Request For a .sys File - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Banker.Delf Infection variant 4 - Sending Initial Email to Owner |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL RPC portmap rexd request UDP |
rev 9 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET GAMES Gold VIP Club Casino Client in Use |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE [AV] EarthWorm/Termite IoT Agent Reporting Infection |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET EXPLOIT php script base64 encoded Remote Code Execution 2 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ChinaZ DDoS Bot Checkin 2 |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB D$ unicode share access |
rev 9 |
2019-07-26 |