| snort |
ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M3 |
rev 2 |
2019-04-16 |
| snort |
ET POLICY Possible WMI .mof Managed Object File Use Over SMB |
rev 1 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 2 |
2019-04-16 |
| snort |
ET POLICY Possible Powershell .ps1 Script Use Over SMB |
rev 1 |
2019-04-16 |
| snort |
ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement |
rev 3 |
2019-04-16 |
| snort |
ET POLICY External IP Check myexternalip.com |
rev 2 |
2019-04-12 |
| snort |
ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Tunneled RDP Handshake |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Tunneled RDP msts Handshake |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement |
rev 2 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound |
rev 2 |
2019-04-04 |
| snort |
ET TROJAN AHK/BKDR_HTV.ZKGD-A CnC Checkin |
rev 2 |
2019-04-04 |
| snort |
ET ATTACK_RESPONSE LaZagne Artifact Outbound in FTP |
rev 1 |
2019-04-04 |
| snort |
ET MOBILE_MALWARE Android/BasBanke CnC Checkin |
rev 2 |
2019-04-04 |
| snort |
ET POLICY Possible Successful Phish - Password Submitted to *.000webhostapp.com |
rev 2 |
2019-04-03 |
| snort |
ET TROJAN Xwo CnC Activity |
rev 2 |
2019-04-02 |
| snort |
ET TROJAN ServHelper CnC Inital Checkin |
rev 3 |
2019-04-01 |
| snort |
ET TROJAN Evil PDF Retrieving Emotet Payload |
rev 2 |
2019-03-28 |
| snort |
ET TROJAN Suspicious POST with Common Windows Process Names - Possible Process List Exfiltration |
rev 3 |
2019-03-28 |
| snort |
ET TROJAN W32/VBS.SLoad.Backdoor Initial Base64 Encoded OK Server Response |
rev 1 |
2019-03-27 |
| snort |
ET INFO SUSPICIOUS SMTP EXE - EXE SMTP Attachment |
rev 2 |
2019-03-27 |
| snort |
ET TROJAN JasperLoader CnC Checkin |
rev 3 |
2019-03-27 |