| snort |
ET WEB_SPECIFIC_APPS Piwik Backdoor Access 2 |
rev 1 |
2012-11-28 |
| snort |
ET SCAN SFTP/FTP Password Exposure via sftp-config.json |
rev 1 |
2012-11-27 |
| snort |
ET WEB_SERVER WebShell - PostMan |
rev 6 |
2012-11-27 |
| snort |
ET CURRENT_EVENTS Possible Glazunov Java payload request /5-digit |
rev 1 |
2012-11-24 |
| snort |
ET WEB_SERVER WebShell - Unknown - .php?x=img&img= |
rev 1 |
2012-11-24 |
| snort |
ET WEB_SERVER WebShell - PHP eMailer |
rev 1 |
2012-11-24 |
| snort |
ET WEB_SERVER WebShell - Unknown - self-kill |
rev 1 |
2012-11-24 |
| snort |
ET WEB_SERVER WebShell - Generic - c99shell based header |
rev 1 |
2012-11-21 |
| snort |
ET WEB_SERVER WebShell - Generic - c99shell based POST structure w/multipart |
rev 1 |
2012-11-21 |
| snort |
ET WEB_SERVER WebShell - Generic - c99shell based header w/colons |
rev 2 |
2012-11-21 |
| snort |
ET WEB_SERVER WebShell - D.K - Title |
rev 1 |
2012-11-21 |
| snort |
ET TROJAN Win32/TrojanDownloader.Wauchos.A CnC Activity |
rev 1 |
2012-11-20 |
| snort |
ET CURRENT_EVENTS KaiXin Exploit Kit Landing Page NOP String |
rev 2 |
2012-11-14 |
| snort |
ET CURRENT_EVENTS CirtXPack - No Java URI - /a.Test |
rev 1 |
2012-11-14 |
| snort |
ET CURRENT_EVENTS CritXPack Landing Page |
rev 1 |
2012-11-14 |
| snort |
ET CURRENT_EVENTS CritXPack - No Java URI - Dot.class |
rev 1 |
2012-11-14 |
| snort |
ET WEB_CLIENT Microsoft Excel file download - SET 1 |
rev 3 |
2012-11-13 |
| snort |
ET POLICY Maxmind geoip check to /app/geoip.js |
rev 1 |
2012-11-13 |
| snort |
ET TROJAN indux.php check-in |
rev 3 |
2012-11-07 |
| snort |
ET CURRENT_EVENTS Probable Sakura Java applet with obfuscated URL Sep 21 2012 |
rev 2 |
2012-11-07 |
| snort |
ET TROJAN Potentially Unwanted Program RebateInformerSetup.exe Download Reporting |
rev 2 |
2012-11-02 |
| snort |
ET TROJAN Georbot requesting update |
rev 1 |
2012-11-01 |
| snort |
ET TROJAN Georbot checkin |
rev 2 |
2012-11-01 |
| snort |
ET TROJAN Georbot initial checkin |
rev 1 |
2012-11-01 |
| snort |
ET INFO Imposter USPS Domain |
rev 1 |
2012-10-27 |
| snort |
ET INFO LLNMR query response to wpad |
rev 2 |
2012-10-25 |
| snort |
ET WEB_CLIENT Microsoft OLE Compound File Magic Bytes Flowbit Set |
rev 7 |
2012-10-22 |
| snort |
ET WEB_SERVER FaTaLisTiCz_Fx Webshell Detected |
rev 1 |
2012-10-18 |
| snort |
ET TROJAN Win32/Fujacks Activity |
rev 11 |
2012-10-18 |
| snort |
ET TROJAN Backdoor.Win32.Pushdo.s Checkin |
rev 2 |
2012-10-17 |
| snort |
ET TROJAN Taidoor Checkin |
rev 1 |
2012-10-17 |
| snort |
ET WEB_SPECIFIC_APPS PhpTax Possible Remote Code Exec |
rev 2 |
2012-10-12 |
| snort |
ET CURRENT_EVENTS BegOpEK - TDS - icon.php |
rev 1 |
2012-10-10 |
| snort |
ET WEB_CLIENT Microsoft Rich Text File download - SET |
rev 1 |
2012-10-10 |
| snort |
ET CURRENT_EVENTS BegOpEK - Landing Page |
rev 1 |
2012-10-10 |
| snort |
GPL EXPLOIT Microsoft cmd.exe banner |
rev 7 |
2012-10-09 |
| snort |
ET CURRENT_EVENTS Unknown Java Exploit Kit 32-32 byte hex initial landing |
rev 1 |
2012-10-05 |
| snort |
ET SCAN Nessus Netbios Scanning |
rev 2 |
2012-10-01 |
| snort |
ET WEB_SPECIFIC_APPS WebC.be Fichier_a_telecharger Parameter Local File Disclosure Attempt |
rev 2 |
2012-09-28 |
| snort |
ET POLICY Kindle Fire Browser User-Agent Outbound |
rev 2 |
2012-09-28 |