| snort |
ET TROJAN MSIL/DataMilk Stealer Communicating with CnC |
rev 1 |
2019-03-25 |
| snort |
ET TROJAN ShadowHammer DNS Lookup |
rev 2 |
2019-03-25 |
| snort |
ET TROJAN Possible ShadowHammer DNS Lookup |
rev 2 |
2019-03-25 |
| snort |
ET TROJAN ChaseBot CnC Checkin |
rev 2 |
2019-03-25 |
| snort |
ET TROJAN Win32/Dorv Stealer Exfiltrating Data to CnC |
rev 4 |
2019-03-25 |
| snort |
ET EXPLOIT Linksys E-Series Device RCE Attempt |
rev 3 |
2019-03-25 |
| snort |
ET TROJAN Possible ShadowHammer DNS Lookup |
rev 2 |
2019-03-25 |
| snort |
ET TROJAN RocketMan Win32/Drun |
rev 2 |
2019-03-24 |
| snort |
ET TROJAN Win32/Spy.Agent.POX Variant CnC |
rev 2 |
2019-03-22 |
| snort |
ET TROJAN Win32/Emotet CnC Checkin Response |
rev 4 |
2019-03-20 |
| snort |
ET EXPLOIT Possible ZTE ZXV10 H108L Router Root RCE Attempt |
rev 2 |
2019-03-19 |
| snort |
ET EXPLOIT Possible Linksys E1500/E2500 apply.cgi RCE Attempt |
rev 2 |
2019-03-19 |
| snort |
ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt |
rev 2 |
2019-03-19 |
| snort |
ET TROJAN Win32/Dorv InfoStealer CnC DNS Query |
rev 2 |
2019-03-18 |
| snort |
ET TROJAN Possible Inbound PowerShell via Invoke-PSImage Stego |
rev 2 |
2019-03-18 |
| snort |
ET EXPLOIT Possible WePresent WIPG1000 File Inclusion |
rev 2 |
2019-03-18 |
| snort |
ET EXPLOIT Possible Linksys WAP54Gv3 Remote Debug Root Shell Exploitation Attempt |
rev 2 |
2019-03-18 |
| snort |
ET TROJAN Win32/Termite Agent Implant Keep-Alive |
rev 2 |
2019-03-14 |
| snort |
ET TROJAN Win32/Termite Agent Implant CnC Checkin |
rev 2 |
2019-03-14 |
| snort |
ET TROJAN Win32/PirateMatryoshka CnC DNS Query |
rev 2 |
2019-03-13 |
| snort |
ET WEB_CLIENT PirateBay Phish - Possibly PirateMatryoshka Related |
rev 2 |
2019-03-13 |
| snort |
ET TROJAN Win32/Retadup CnC Checkin M2 |
rev 2 |
2019-03-13 |
| snort |
ET TROJAN Win32/Retadup CnC Checkin M1 |
rev 2 |
2019-03-13 |
| snort |
ET CURRENT_EVENTS Spelevo EK Landing M1 |
rev 2 |
2019-03-11 |
| snort |
ET EXPLOIT CVE-2018-8174 Common Construct B64 M2 |
rev 2 |
2019-03-11 |
| snort |
ET CURRENT_EVENTS Spelevo EK Landing M3 |
rev 2 |
2019-03-11 |
| snort |
ET CURRENT_EVENTS Successful Generic Personalized Phish 2019-03-11 |
rev 2 |
2019-03-11 |
| snort |
ET EXPLOIT CVE-2018-8174 Common Construct B64 M3 |
rev 2 |
2019-03-11 |
| snort |
ET CURRENT_EVENTS Spelevo EK Landing M2 |
rev 2 |
2019-03-11 |
| snort |
ET EXPLOIT CVE-2018-8174 Common Construct B64 M1 |
rev 2 |
2019-03-11 |
| snort |
ET P2P Libtorrent User-Agent |
rev 3 |
2019-03-08 |
| snort |
ET TROJAN Py/MechaFlounder CnC Activity - Reporting Sleep Command Success |
rev 3 |
2019-03-07 |
| snort |
ET CURRENT_EVENTS Successful Generic Mailbox Phish 2019-03-07 |
rev 2 |
2019-03-07 |
| snort |
ET TROJAN [AV] EarthWorm/Termite IoT Agent Reporting Infection |
rev 1 |
2019-03-07 |
| snort |
ET TROJAN Chafer CnC DNS Query |
rev 2 |
2019-03-06 |
| snort |
ET TROJAN FIN6 StealerOne CnC Domain in SNI |
rev 2 |
2019-03-06 |
| snort |
ET TROJAN Py/MechaFlounder CnC Activity - Reporting Upload Command Error |
rev 2 |
2019-03-06 |
| snort |
ET TROJAN MSIL/SkidRat CnC Checkin M3 |
rev 2 |
2019-03-06 |
| snort |
ET TROJAN MSIL/KeyRedirEx Banker Receiving Redirect/Inject List |
rev 3 |
2019-03-06 |
| snort |
ET TROJAN Py/MechaFlounder CnC Activity - Reporting Upload Command Success |
rev 2 |
2019-03-06 |