| suricata |
ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 1 |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS InitiateSystemShutdown unicode attempt |
rev 10 |
2019-07-26 |
| suricata |
ET MALWARE LURK Trojan Communication Protocol detected |
rev 3 |
2019-07-26 |
| suricata |
ET EXPLOIT NB8-04 - Possible Unauthed RCE via whitelist bypass |
rev 1 |
2019-07-26 |
| suricata |
GPL ICMP PING Pinger Windows |
rev 8 |
2019-07-26 |
| suricata |
ET DOS Likely NTP DDoS In Progress PEER_LIST_SUM Response to Non-Ephemeral Port IMPL 0x02 |
rev 3 |
2019-07-26 |
| suricata |
ET WORM W32/Njw0rm CnC Beacon |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB llsrconnect unicode little endian overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL ATTACK_RESPONSE isakmp login failed |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile unicode overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL RPC portmap pcnfsd request UDP |
rev 10 |
2019-07-26 |
| suricata |
ET VOIP Multiple Unauthorized SIP Responses UDP |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Skeleton Key Filename in SMB2 Traffic |
rev 5 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of arguments.callee % Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Microsoft Windows MPEG Layer-3 Audio Decoder Buffer Overflow |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Lazarus FALLCHILL Fake SSL Checkin 1 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO HTTP OPTIONS invalid method case outbound |
rev 2 |
2019-07-26 |
| suricata |
ET ACTIVEX SoftCab Sound Converter ActiveX SaveFormat File overwrite Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB ADMIN$ share access |
rev 14 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE python shell spawn attempt |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN sipscan probe |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Linux/KDefend Checkin |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Remcos RAT Checkin 87 |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS e107 CMS backdoor access admin-access cookie and HTTP POST |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Predator Pain Keylogger FTP |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt |
rev 3 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of String.fromCharCode %u UTF-16 Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET FTP Possible FTP Daemon Username INSERT INTO SQL Injection Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Windows Microsoft Windows DOS prompt command Error not found |
rev 1 |
2019-07-26 |
| suricata |
GPL IMAP status overflow attempt |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE W32.Virut.A joining an IRC Channel |
rev 7 |
2019-07-26 |
| suricata |
ET WEB_CLIENT RealPlayer FLV Parsing Integer Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL SHELLCODE x86 0x71FB7BAB NOOP unicode |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE x0Proto Pong |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible CVE-2016-0777 Server Advertises Suspicious Roaming Support |
rev 2 |
2019-07-26 |
| suricata |
ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Windows systeminfo Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET HUNTING SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M4 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Possible Powershell .ps1 Script Use Over SMB |
rev 2 |
2019-07-26 |