| suricata |
ET INFO Command Shell Activity Over SMB - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Backdoor.Win32.RShot Ping Outbound |
rev 3 |
2019-07-26 |
| suricata |
ET INFO Office Document Containing AutoOpen Macro Via smtp |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN Multiple FTP Root Login Attempts from Single Source - Possible Brute Force Attempt |
rev 3 |
2019-07-26 |
| suricata |
GPL DNS named version attempt |
rev 9 |
2019-07-26 |
| suricata |
ET EXPLOIT IPMI Cipher 0 Authentication mode set |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE W32/Mentory CnC Server Providing Update Details |
rev 2 |
2019-07-26 |
| suricata |
GPL MISC UPnP malformed advertisement |
rev 9 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfiltration |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 4 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC CMSD UDP CMSD_CREATE buffer overflow attempt |
rev 11 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible CVE-2015-7547 Long Response to AAAA lookup |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Linux/Yangji.A Checkin |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Windows driverquery -v Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Behavioral Unusual Port 1434 traffic Potential Scan or Infection |
rev 15 |
2019-07-26 |
| suricata |
ET VOIP Possible Inbound VOIP Scan/Misuse With User-Agent Zoiper |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Proxy - Fiddler Proxy Certificate Seen |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Carbanak APT CnC Beacon 1 |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 7 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Tapazom.A |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 3 |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE Trojan/Win32.Espy Report via SMTP |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt |
rev 6 |
2019-07-26 |
| suricata |
ET ACTIVEX HP Easy Printer Care Software XMLCacheMgr ActiveX Control Remote Code Execution Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Remcos RAT Checkin 73 |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB OpenKey little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE DACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL RPC portmap RQUOTA request UDP |
rev 8 |
2019-07-26 |
| suricata |
GPL ICMP PING IP NetMonitor Macintosh |
rev 8 |
2019-07-26 |
| suricata |
GPL RPC sadmind query with root credentials attempt UDP |
rev 5 |
2019-07-26 |
| suricata |
GPL RPC portmap rwalld request UDP |
rev 10 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS IrotIsRunning little endian attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS DCERPC CoGetInstanceFromFile overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST Requests IMPL 0x03 |
rev 3 |
2019-07-26 |
| suricata |
GPL ICMP PING BeOS4.x |
rev 8 |
2019-07-26 |
| suricata |
ET VOIP Possible Modified Sipvicious OPTIONS Scan |
rev 2 |
2019-07-26 |
| suricata |
ET P2P BitTorrent DHT find_node request |
rev 7 |
2019-07-26 |
| suricata |
ET INFO Office Document Containing AutoExec Macro Via smtp |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE SEASALT Client Checkin |
rev 2 |
2019-07-26 |