| snort |
ET TROJAN ServHelper CnC Domain |
rev 2 |
2019-05-01 |
| snort |
ET TROJAN ServHelper CnC Domain |
rev 2 |
2019-05-01 |
| snort |
ET TROJAN ServHelper CnC Domain |
rev 2 |
2019-05-01 |
| snort |
ET TROJAN Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern |
rev 3 |
2019-04-30 |
| snort |
ET TROJAN DonotGroup CnC Domain in DNS Lookup |
rev 2 |
2019-04-30 |
| snort |
ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement |
rev 2 |
2019-04-30 |
| snort |
ET TROJAN DonotGroup Stage 2 CnC Domain in DNS Lookup |
rev 2 |
2019-04-30 |
| snort |
ET TROJAN APT DNSpionage/Karkoff CnC Domain in DNS Lookup |
rev 3 |
2019-04-30 |
| snort |
ET TROJAN Megumin v2 Stealer User-Agent |
rev 2 |
2019-04-30 |
| snort |
ET TROJAN DonotGroup CnC Domain in DNS Lookup |
rev 2 |
2019-04-29 |
| snort |
ET TROJAN DonotGroup CnC Domain in DNS Lookup |
rev 2 |
2019-04-29 |
| snort |
ET TROJAN DonotGroup CnC Domain in DNS Lookup |
rev 2 |
2019-04-29 |
| snort |
ET TROJAN PS/Beapy CnC Checkin |
rev 3 |
2019-04-25 |
| snort |
ET TROJAN Py/Beapy CnC Checkin |
rev 3 |
2019-04-25 |
| snort |
ET USER_AGENTS Aria2 User-Agent |
rev 2 |
2019-04-25 |
| snort |
ET TROJAN APT DNSpionage/Karkoff CnC Domain in DNS Lookup |
rev 2 |
2019-04-24 |
| snort |
ET TROJAN APT DNSpionage/Karkoff CnC Domain in DNS Lookup |
rev 2 |
2019-04-24 |
| snort |
ET TROJAN StealerNeko CnC Checkin |
rev 2 |
2019-04-23 |
| snort |
ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M1 |
rev 2 |
2019-04-22 |
| snort |
ET NETBIOS DCERPC SVCCTL - Remote Service Control Manager Access |
rev 2 |
2019-04-22 |
| snort |
ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M2 |
rev 2 |
2019-04-22 |
| snort |
ET ATTACK_RESPONSE Windows SCM DLL Hijack Command Inbound via HTTP M3 |
rev 2 |
2019-04-22 |
| snort |
ET TROJAN [PTsecurity] Possible Cobalt Strike payload |
rev 3 |
2019-04-19 |
| snort |
ET USER_AGENTS ESET Installer |
rev 2 |
2019-04-17 |
| snort |
ET POLICY Possible Powershell .ps1 Script Use Over SMB |
rev 1 |
2019-04-16 |
| snort |
ET POLICY Possible WMI .mof Managed Object File Use Over SMB |
rev 1 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-04-16 |
| snort |
ET POLICY Possible WMI .mof Managed Object File Use Over SMB |
rev 1 |
2019-04-16 |
| snort |
ET POLICY Possible Powershell .ps1 Script Use Over SMB |
rev 1 |
2019-04-16 |
| snort |
ET POLICY Powershell Activity Over SMB - Likely Lateral Movement |
rev 2 |
2019-04-16 |
| snort |
ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M2 |
rev 2 |
2019-04-16 |
| snort |
ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M3 |
rev 2 |
2019-04-16 |
| snort |
ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M1 |
rev 2 |
2019-04-16 |
| snort |
ET POLICY Powershell Activity Over SMB - Likely Lateral Movement |
rev 2 |
2019-04-16 |
| snort |
ET POLICY External IP Check myexternalip.com |
rev 2 |
2019-04-12 |
| snort |
ET POLICY Tunneled RDP Handshake |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2019-04-11 |