| suricata |
ET COINMINER CoinMiner Malicious Authline Seen After CVE-2017-10271 Exploit |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE PWS Win32/Lmir.BMQ checkin |
rev 3 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of document.write % Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET INFO PTUNNEL INBOUND |
rev 3 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 11 |
rev 2 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Microsoft CScript Banner Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Command Shell Activity Over SMB - Possible Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Windows set Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Suspicious inbound to mySQL port 3306 |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 2 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Possible Chimera Ransomware - Bitmessage Activity |
rev 1 |
2019-07-26 |
| suricata |
ET ACTIVEX Microsoft Internet Explorer Tabular DataURL ActiveX Control Memory Corruption Attempt |
rev 8 |
2019-07-26 |
| suricata |
ET SCADA Golden FTP Server PASS Command Remote Buffer Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS CoGetInstanceFromFile overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP Write Request |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile attempt |
rev 4 |
2019-07-26 |
| suricata |
ET SCAN SSH BruteForce Tool with fake PUTTY version |
rev 6 |
2019-07-26 |
| suricata |
ET SCAN Rapid POP3S Connections - Possible Brute Force Attack |
rev 7 |
2019-07-26 |
| suricata |
ET MALWARE Py/MechaFlounder CnC Activity - Reporting Upload Command Error |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of document.write # Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Win32.ChinaZ.DDoSClient Checkin |
rev 2 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP ACK |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE [AV] EarthWorm/Termite IoT Agent Reporting Infection |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown unicode little endian attempt |
rev 6 |
2019-07-26 |
| suricata |
ET SCAN Multiple FTP Administrator Login Attempts from Single Source - Possible Brute Force Attempt |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE ELF.STD.ddos Checkin |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Gh0st Trojan CnC 3 |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC portmap status request UDP |
rev 9 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Executable contained in DICOM Medical Image PACS DICOM Protocol Transfer |
rev 1 |
2019-07-26 |
| suricata |
ET P2P Octoshape P2P streaming media |
rev 4 |
2019-07-26 |
| suricata |
ET INFO Office Document Containing AutoOpen Macro Via smtp |
rev 2 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP Error Message |
rev 3 |
2019-07-26 |
| suricata |
GPL DNS named iquery attempt |
rev 9 |
2019-07-26 |
| suricata |
ET EXPLOIT Cisco Smart Install Exploitation Tool - Update Ios and Execute |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC portmap sadmind request UDP |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE Possible Emotet DGA NXDOMAIN Responses |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Denisca.A CnC Beacon 2 |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC portmap rusers request UDP |
rev 12 |
2019-07-26 |
| suricata |
ET MALWARE Windows WMIC STARTUP get Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |