| snort |
ET TROJAN FlawedGrace CnC Activity |
rev 2 |
2018-10-16 |
| snort |
ET TROJAN [PTsecurity] Remcos RAT Checkin 69 |
rev 1 |
2018-10-16 |
| snort |
ET TROJAN [PTsecurity] Remcos RAT Checkin 71 |
rev 1 |
2018-10-16 |
| snort |
ET TROJAN [PTsecurity] Remcos RAT Checkin 70 |
rev 1 |
2018-10-16 |
| snort |
ET TROJAN [PTsecurity] Remcos RAT Checkin 73 |
rev 1 |
2018-10-16 |
| snort |
ET TROJAN [PTsecurity] Remcos RAT Checkin 72 |
rev 1 |
2018-10-16 |
| snort |
ET TROJAN Malicious XLS DDE rar Drop Fake 404 Response |
rev 1 |
2018-10-16 |
| snort |
ET SCAN StarDotStar HELO, suspected AUTH LOGIN botnet |
rev 3 |
2018-10-12 |
| snort |
ET TROJAN Win32.YordanyanActiveAgent Generic CnC Pattern |
rev 2 |
2018-10-04 |
| snort |
ET TROJAN NCSC APT28 - Web/request -FILE- contenttype |
rev 2 |
2018-10-04 |
| snort |
ET TROJAN NCSC XAgent itwm beacon v2 |
rev 1 |
2018-10-04 |
| snort |
ET TROJAN NCSC XAgent itwm beacon v1 |
rev 1 |
2018-10-04 |
| snort |
ET POLICY Suspicious Malformed Double Accept Header |
rev 14 |
2018-10-03 |
| snort |
ET TROJAN VPNFilter htpx Module C2 Request |
rev 1 |
2018-10-01 |
| snort |
ET CURRENT_EVENTS Generic MRxJoker Phishing Landing 2018-09-27 |
rev 2 |
2018-09-27 |
| snort |
ET CURRENT_EVENTS Successful Generic Personalized Phish 2018-09-27 M2 |
rev 2 |
2018-09-27 |
| snort |
ET TROJAN Suspected DNS2TCP Auth |
rev 2 |
2018-09-26 |
| snort |
ET TROJAN Suspected DNS2TCP Connect |
rev 2 |
2018-09-26 |
| snort |
ET TROJAN Suspected fraud-bridge DNS Tunnel |
rev 2 |
2018-09-26 |
| snort |
ET WEB_SERVER JSP.SJavaWebManage WebShell Access |
rev 3 |
2018-09-25 |
| snort |
ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 1 |
rev 3 |
2018-09-25 |
| snort |
ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 2 |
rev 3 |
2018-09-25 |
| snort |
ET TROJAN Observed UltraVNC CnC Activity |
rev 2 |
2018-09-21 |
| snort |
ET TROJAN HTML/Xbash Hex Encoded WScript.Shell Inbound - Stage 1 |
rev 2 |
2018-09-20 |
| snort |
ET TROJAN HTML/Xbash Hex Encoded PS WebClient Object Inbound - Stage 1 |
rev 2 |
2018-09-20 |
| snort |
ET TROJAN HTML/Xbash Hex Encoded PowerShell Args Inbound - Stage 1 |
rev 2 |
2018-09-20 |
| snort |
ET CURRENT_EVENTS Possible Tor/Noscript JS Bypass |
rev 2 |
2018-09-11 |
| snort |
ET EXPLOIT NetGain Enterprise Manager 7.2.562 Ping Command Injection |
rev 2 |
2018-09-10 |
| snort |
ET USER_AGENTS MSIL/Peppy User-Agent |
rev 2 |
2018-09-07 |
| snort |
ET TROJAN Win32/Aura Ransomware CnC Activity |
rev 2 |
2018-09-06 |
| snort |
ET TROJAN MSIL/Eredel Stealer CnC Checkin |
rev 4 |
2018-09-06 |
| snort |
ET TROJAN Suspected Monero Miner CnC Channel Secondary Domain Lookup |
rev 1 |
2018-09-05 |
| snort |
ET TROJAN OilRig OopsIE CnC Checkin M4 |
rev 2 |
2018-09-05 |
| snort |
ET EXPLOIT Ghostscript invalidcheck escape attempt |
rev 1 |
2018-09-05 |
| snort |
ET EXPLOIT Ghostscript setpattern type confusion attempt |
rev 1 |
2018-09-05 |
| snort |
ET TROJAN Win32/BanloadDownloader.XZY Retrieving Payload |
rev 3 |
2018-09-05 |
| snort |
ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt |
rev 2 |
2018-09-05 |
| snort |
ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt |
rev 1 |
2018-09-05 |
| snort |
ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt |
rev 1 |
2018-09-05 |
| snort |
ET EXPLOIT Ghostscript illegal read undefinedfilename attempt |
rev 1 |
2018-09-05 |