| suricata |
GPL NETBIOS SMB OpenKey unicode little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET FTP Possible FTP Daemon Username UNION SELECT SQL Injection Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP Error Message |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET DOS Likely NTP DDoS In Progress GET_RESTRICT Response to Non-Ephemeral Port IMPL 0x03 |
rev 4 |
2019-07-26 |
| suricata |
GPL CHAT MSN outbound file transfer request |
rev 7 |
2019-07-26 |
| suricata |
ET MALWARE Py/MechaFlounder CnC Activity - Reporting Upload Command Success |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC portmap kcms_server request UDP |
rev 11 |
2019-07-26 |
| suricata |
ET EXPLOIT Oracle Weblogic Server Deserialization Remote Command Execution |
rev 1 |
2019-07-26 |
| suricata |
ET FTP Possible FTP Daemon Username INTO OUTFILE SQL Injection Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Noction IRP Probe |
rev 1 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP ACK |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Win32.ChinaZ.DDoSClient Checkin |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ChinaZ DDoS Bot Checkin 2 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Windows WMIC SYSACCOUNT get Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
GPL IMAP subscribe overflow attempt |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Lazarus FALLCHILL Fake SSL Checkin 2 |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT NB8-02 - Possible Unauthed RCE via nbbsdtar |
rev 1 |
2019-07-26 |
| suricata |
ET HUNTING Possible Powershell .ps1 Script Use Over SMB |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt |
rev 5 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP Read Request |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Observed UltraVNC CnC Activity |
rev 2 |
2019-07-26 |
| suricata |
ET FTP Possible FTP Daemon Username DELETE FROM SQL Injection Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS OpenKey little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown unicode little endian attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE Windows WMIC NETLOGIN get Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB D$ unicode share access |
rev 9 |
2019-07-26 |
| suricata |
ET MALWARE Trojan.Delf-5496 New Infection Report |
rev 5 |
2019-07-26 |
| suricata |
GPL CHAT MSN outbound file transfer accept |
rev 6 |
2019-07-26 |
| suricata |
GPL RPC portmap UNSET attempt UDP 111 |
rev 6 |
2019-07-26 |
| suricata |
GPL RPC portmap status request UDP |
rev 9 |
2019-07-26 |
| suricata |
GPL RPC portmap bootparam request UDP |
rev 14 |
2019-07-26 |
| suricata |
ET MALWARE ZeroAccess udp traffic detected |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 3 |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN H.323 Scanning device |
rev 2 |
2019-07-26 |
| suricata |
ET DOS Possible Memcached DDoS Amplification Inbound |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS Yahoo CD Player ActiveX Open Stack Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of document.write # Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SERVER PHP Large Subnormal Double Precision Floating Point Number PHP DoS Inbound |
rev 1 |
2019-07-26 |