| suricata |
ET MALWARE Executable contained in DICOM Medical Image Received from PACS DICOM Device |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC portmap UNSET attempt UDP 111 |
rev 6 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of String.fromCharCode %u UTF-8 Encoding |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Denisca.A CnC Beacon 2 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Gimmiv Infection Ping Outbound |
rev 3 |
2019-07-26 |
| suricata |
GPL ICMP PING Flowpoint2200 or Network Management Software |
rev 7 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt |
rev 5 |
2019-07-26 |
| suricata |
ET SCAN SSH BruteForce Tool with fake PUTTY version |
rev 6 |
2019-07-26 |
| suricata |
GPL RPC portmap espd request UDP |
rev 13 |
2019-07-26 |
| suricata |
GPL RPC portmap sadmind request UDP |
rev 8 |
2019-07-26 |
| suricata |
ET INFO SMB2 NT Create AndX Request For a Powershell .ps1 File |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SERVER PHP Large Subnormal Double Precision Floating Point Number PHP DoS Inbound |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ShellshockCampaign.DDOSBot Reporting IP |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL CHAT MSN outbound file transfer rejected |
rev 7 |
2019-07-26 |
| suricata |
GPL RPC portmap rusers request UDP |
rev 12 |
2019-07-26 |
| suricata |
ET MALWARE Observed UltraVNC CnC Activity |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 2 |
rev 1 |
2019-07-26 |
| suricata |
ET HUNTING SUSPICIOUS IRC - NICK and 3 Letter Country Code |
rev 6 |
2019-07-26 |
| suricata |
ET SCADA Golden FTP Server PASS Command Remote Buffer Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE CommentCrew UGX Backdoor initial connection |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE FakeM RAT CnC Beacon |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ChinaZ 2.0 DDoS Bot Checkin 3 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Windows Microsoft Windows DOS prompt command Error not recognized |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Perl/Shellbot.SM IRC CnC Checkin |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT NB8-01 - Unauthed RCE via bprd |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE W32.Duptwux/Ganelp FTP Username - onthelinux |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE DACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Gh0st Remote Access Trojan Encrypted Session To CnC Server |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown unicode attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE Carbanak APT CnC Beacon 1 |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN Rapid POP3 Connections - Possible Brute Force Attack |
rev 7 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Output of id command from HTTP server |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL RPC portmap RQUOTA request UDP |
rev 8 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains wininet.dll Call - Potentially Dridex MalDoc 3 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation unicode little endian attempt |
rev 4 |
2019-07-26 |