| snort |
ET TROJAN Haxdoor Reporting User Activity 2 |
rev 7 |
2013-04-10 |
| snort |
ET CURRENT_EVENTS RedKit applet + obfuscated URL Apr 7 2013 |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel Infection or Config URL Request |
rev 1 |
2013-04-09 |
| snort |
ET INFO Suspicious services.exe in URI |
rev 12 |
2013-04-09 |
| snort |
ET INFO Suspicious csrss.exe in URI |
rev 11 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel Pro File.php CnC POST |
rev 1 |
2013-04-09 |
| snort |
ET INFO Suspicious lsass.exe in URI |
rev 11 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel Conf.bin Download From CnC Server |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN W32/NSISDL.Downloader CnC Server Response |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel File.php CnC POST |
rev 1 |
2013-04-09 |
| snort |
ET INFO Suspicious winlogin.exe in URI |
rev 12 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel Content.php CnC POST |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN Revoyem Ransomware Check-in |
rev 3 |
2013-04-06 |
| snort |
ET SHELLCODE Possible Backslash Escaped UTF-8 0c0c Heap Spray |
rev 1 |
2013-04-04 |
| snort |
ET TROJAN W32/BaneChant.APT Winword.pkg Redirect |
rev 1 |
2013-04-04 |
| snort |
ET WEB_SERVER WebShell - MySQL Interface - Auth Prompt |
rev 1 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/0 |
rev 1 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/7 |
rev 1 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/9 |
rev 1 |
2013-04-02 |
| snort |
ET CURRENT_EVENTS DRIVEBY EgyPack Exploit Kit Cookie Set |
rev 3 |
2013-04-02 |
| snort |
ET CURRENT_EVENTS Probable Sakura exploit kit landing page obfuscated applet tag Mar 28 2013 |
rev 2 |
2013-04-02 |
| snort |
ET CURRENT_EVENTS DRIVEBY EgyPack Exploit Kit Cookie Present |
rev 3 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/8 |
rev 1 |
2013-04-02 |
| snort |
ET TROJAN Win32/Delfinject Check-in |
rev 2 |
2013-03-28 |
| snort |
ET WEB_SERVER WebShell Generic - netsh firewall |
rev 1 |
2013-03-27 |
| snort |
ET WEB_SERVER WebShell Generic - wget http - POST |
rev 1 |
2013-03-27 |
| snort |
ET WEB_SERVER WebShell - Simple - Title |
rev 1 |
2013-03-27 |
| snort |
ET WEB_SERVER WebShell - JSPCMD - Form |
rev 1 |
2013-03-27 |
| snort |
ET WEB_SERVER WebShell Generic - reg HKEY_LOCAL_MACHINE |
rev 1 |
2013-03-27 |
| snort |
ET WEB_SERVER LOIC Javascript DDoS Inbound |
rev 4 |
2013-03-25 |
| snort |
ET TROJAN [CrowdStrike] ANCHOR PANDA - Adobe Gh0st Beacon |
rev 2 |
2013-03-23 |
| snort |
ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message |
rev 2 |
2013-03-23 |
| snort |
ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message Header Local |
rev 2 |
2013-03-23 |
| snort |
ET WEB_SERVER PHP tags in HTTP POST |
rev 4 |
2013-03-22 |
| snort |
ET WEB_SERVER Possible Perl Shell in HTTP POST |
rev 5 |
2013-03-22 |
| snort |
ET TROJAN Galock Ransomware Check-in |
rev 1 |
2013-03-22 |
| snort |
ET TROJAN Galock Ransomware Command |
rev 1 |
2013-03-22 |
| snort |
ET CURRENT_EVENTS Watering Hole applet name AppletHigh.jar |
rev 1 |
2013-03-22 |
| snort |
ET WEB_SERVER Possible Perl Shell in HTTP POST |
rev 5 |
2013-03-22 |
| snort |
ET TROJAN Backdoor.Win32.Xtrat Checkin 2 |
rev 4 |
2013-03-20 |