| suricata |
ET NETBIOS Microsoft Windows Server 2003 Active Directory Pre-Auth BROWSER ELECTION Heap Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL ICMP PING Network Toolbox 3 Windows |
rev 8 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Microsoft WMIC Prompt Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Behavioral Unusual Port 137 traffic Potential Scan or Infection |
rev 15 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of charCodeAt %u UTF-16 Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT RealPlayer FLV Parsing Integer Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile little endian attempt |
rev 4 |
2019-07-26 |
| suricata |
ET HUNTING Suspicious Percentage Symbol Usage in FTP Username |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile unicode attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS llsrconnect little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE MSIL/Golroted.B Keylogger FTP |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Office Document Containing AutoOpen Macro Via smtp |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN DCERPC rpcmgmt ifids Unauthenticated BIND |
rev 3 |
2019-07-26 |
| suricata |
ET SCADA CitectSCADA ODBC Overflow Attempt |
rev 8 |
2019-07-26 |
| suricata |
ET INFO WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attacking Message |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Remcos RAT Checkin 87 |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation unicode little endian attempt |
rev 4 |
2019-07-26 |
| suricata |
ET INFO SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC portmap ypserv request UDP |
rev 13 |
2019-07-26 |
| suricata |
ET MALWARE ProxyBox - ProxyBotCommand - I_AM |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN Suspicious inbound to MSSQL port 1433 |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Windows quser Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET HUNTING SUSPICIOUS IRC - NICK and Win |
rev 4 |
2019-07-26 |
| suricata |
GPL SHELLCODE x86 0x71FB7BAB NOOP unicode |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS C$ share access |
rev 12 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Possible Kali Linux hostname in DHCP Request Packet |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Windows-Based OpenSSL Tunnel Connection Outbound 3 |
rev 4 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Net User Command Response |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS OpenKey unicode overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE US-CERT TA14-353A Wiper 2 |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Spy.Agent.OHT - AnunakAPT TCP Keep-Alive |
rev 2 |
2019-07-26 |
| suricata |
ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 - Known Exploit Instance |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Phorpiex Template 4 Active - Outbound Malicious Email Spam |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Codesoft PW Stealer Email Report Outbound |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB llsrconnect little endian overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown unicode attempt |
rev 6 |
2019-07-26 |