| suricata |
GPL NETBIOS SMB OpenKey little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET SCAN StarDotStar HELO, suspected AUTH LOGIN botnet |
rev 3 |
2019-07-26 |
| suricata |
ET P2P Ares Server Connection |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt |
rev 6 |
2019-07-26 |
| suricata |
ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection |
rev 15 |
2019-07-26 |
| suricata |
GPL TFTP GET Admin.dll |
rev 5 |
2019-07-26 |
| suricata |
ET SCAN Rapid IMAP Connections - Possible Brute Force Attack |
rev 7 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS InitiateSystemShutdown unicode little endian attempt |
rev 10 |
2019-07-26 |
| suricata |
ET P2P GnucDNA UDP Ultrapeer Traffic |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Remcos RAT Checkin 71 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE x0Proto Client Info |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Bitter RAT C2 Response |
rev 2 |
2019-07-26 |
| suricata |
GPL TFTP GET passwd |
rev 5 |
2019-07-26 |
| suricata |
ET HUNTING Windows nbtstat -r Microsoft Windows DOS prompt command exit OUTBOUND |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN ICMP Delphi Likely Precursor to Scan |
rev 3 |
2019-07-26 |
| suricata |
ET SHELLCODE Rothenburg Shellcode |
rev 3 |
2019-07-26 |
| suricata |
ET P2P Edonkey Connect Request |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Windows WMIC SHARE get Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Mashigoom/Tranwos/RevProxy ClickFraud - hello |
rev 6 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt |
rev 5 |
2019-07-26 |
| suricata |
ET INFO SMB Remote AT Scheduled Job Pipe Creation |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 3 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE MAGICHOUND.LEASH IRC CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Suspected ExtraPulsar Backdoor |
rev 3 |
2019-07-26 |
| suricata |
ET HUNTING SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M3 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Gimmiv Infection Ping Outbound |
rev 3 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Possible # Encoded Iframe Tag |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Lethic - Client Alive |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt |
rev 5 |
2019-07-26 |
| suricata |
ET SCAN Port Unreachable Response to Xprobe2 OS Fingerprint Scan |
rev 3 |
2019-07-26 |
| suricata |
GPL SHELLCODE SGI NOOP |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE Optix Pro Trojan/Keylogger Reporting Installation via Email |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE OSX/Mami Possible DNS Query to Evil DNS Server |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Perfect Keylogger FTP Initial Install Log Upload |
rev 3 |
2019-07-26 |
| suricata |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attack Done Message |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Exploited Message |
rev 3 |
2019-07-26 |
| suricata |
ET SCAN Suspicious inbound to Oracle SQL port 1521 |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS InitiateSystemShutdown unicode attempt |
rev 10 |
2019-07-26 |
| suricata |
ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC Scanning Message |
rev 2 |
2019-07-26 |