| snort |
ET TROJAN W32/Liftoh.Downloader Feed404 CnC Beacon |
rev 1 |
2013-12-17 |
| snort |
ET TROJAN W32/Liftoh.Downloader Get Final Payload Request |
rev 2 |
2013-12-17 |
| snort |
ET TROJAN W32/Liftoh.Downloader Images CnC Beacon |
rev 1 |
2013-12-17 |
| snort |
ET TROJAN W32/Ke3chang.MovieStar.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.MyWeb.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.MyWeb.APT Eourdegh Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN WEBC2-QBP Checkin Response 1 - Embedded CnC APT1 Related |
rev 2 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.Dream.APT Campaign CnC Beacon 2 |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.Snake.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN Vawtrak/NeverQuest Checkin |
rev 1 |
2013-12-12 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Exploited Message |
rev 3 |
2013-12-10 |
| snort |
ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC No Open Ports Message |
rev 1 |
2013-12-10 |
| snort |
ET TROJAN Common Zbot EXE filename Dec 09 2013 |
rev 1 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attacking Message |
rev 2 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Mambo Scanning Message |
rev 2 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS PerlBot Version Message |
rev 2 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attack Done Message |
rev 1 |
2013-12-10 |
| snort |
ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC Scanning Message |
rev 2 |
2013-12-10 |
| snort |
ET WEB_SERVER IIS ISN BackDoor Command GetLog |
rev 4 |
2013-12-10 |
| snort |
ET CURRENT_EVENTS Probable Sakura exploit kit landing page obfuscated applet tag Mar 1 2013 |
rev 4 |
2013-12-09 |
| snort |
ET WEB_SPECIFIC_APPS SAP Possible CTC Auth/HTTP Verb Bypass Attempt |
rev 2 |
2013-12-06 |
| snort |
ET WEB_SERVER Possible MySQL SQLi User-Dump Attempt |
rev 2 |
2013-12-06 |
| snort |
ET WEB_SERVER Possible WebLogic Operator Login With Default Creds |
rev 1 |
2013-12-06 |
| snort |
ET WEB_SERVER Possible WebLogic Admin Login With Default Creds |
rev 3 |
2013-12-06 |
| snort |
ET WEB_SERVER Possible MySQL SQLi Attempt Information Schema Access |
rev 1 |
2013-12-06 |
| snort |
ET WEB_SERVER Possible WebLogic Monitor Login With Default Creds |
rev 2 |
2013-12-06 |
| snort |
ET WEB_SERVER Possible WebLogic Admin Login With Default Creds |
rev 2 |
2013-12-06 |
| snort |
ET TROJAN Darkness DDoS HTTP Target/EXE |
rev 6 |
2013-11-27 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing management MBeanServer |
rev 1 |
2013-11-26 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Mozilla JS Class Creation |
rev 1 |
2013-11-26 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing glassfish external statistics impl |
rev 1 |
2013-11-26 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing jmx mbeanserver |
rev 1 |
2013-11-26 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing mbeanserver Introspector |
rev 1 |
2013-11-26 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing tracing Provider Factory |
rev 1 |
2013-11-26 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Importing Classes used in awt exploits |
rev 1 |
2013-11-26 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class Hex Encoded Class file |
rev 1 |
2013-11-26 |
| snort |
ET INFO Java Downloading Class flowbit no alert |
rev 5 |
2013-11-25 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class B64 encoded class |
rev 1 |
2013-11-25 |
| snort |
ET WEB_CLIENT SUSPICIOUS Java Request With Uncompressed JAR/Class file Accessing Security Manager |
rev 1 |
2013-11-25 |
| snort |
ET INFO Java Downloading Archive flowbit no alert |
rev 5 |
2013-11-25 |