| snort |
ET CURRENT_EVENTS Successful Generic Credential Phish Activity POST |
rev 1 |
2021-10-27 |
| suricata |
ET EXPLOIT PHP Melody v3.0 SQL Injection Attempt |
rev 1 |
2021-10-27 |
| suricata |
ET PHISHING Successful Generic Credential Phish Activity POST |
rev 2 |
2021-10-27 |
| suricata |
ET EXPLOIT PHP Melody v3.0 SQL Injection Attempt |
rev 1 |
2021-10-27 |
| suricata |
ET PHISHING Successful Generic Credential Phish Activity POST |
rev 2 |
2021-10-27 |
| suricata |
ET PHISHING Generic Credential Phish Activity GET |
rev 2 |
2021-10-27 |
| snort |
ET SCAN FTPSync Settings Disclosure Attempt |
rev 2 |
2021-10-26 |
| sigma |
Linux Crypto Mining Pool Connections |
stable |
2021-10-26 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 1 |
2021-10-25 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 1 |
2021-10-25 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 1 |
2021-10-25 |
| snort |
ET TROJAN Ousaban Banker KeepAlive |
rev 1 |
2021-10-25 |
| snort |
ET CURRENT_EVENTS Successful Zoom.us Phish 2021-10-25 |
rev 2 |
2021-10-25 |
| snort |
ET TROJAN Ousaban Banker Checkin M2 |
rev 2 |
2021-10-25 |
| snort |
ET TROJAN Ousaban Banker Server Response M2 |
rev 2 |
2021-10-25 |
| snort |
ET TROJAN Ousaban Banker Server Response M1 |
rev 2 |
2021-10-25 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 1 |
2021-10-25 |
| snort |
ET TROJAN Ousaban Banker Checkin M1 |
rev 2 |
2021-10-25 |
| snort |
ET TROJAN Ousaban Banker KeepAlive Response |
rev 1 |
2021-10-25 |
| suricata |
ET MALWARE Ousaban Banker Server Response M1 |
rev 1 |
2021-10-25 |
| suricata |
ET MALWARE Ousaban Banker Checkin M2 |
rev 1 |
2021-10-25 |
| suricata |
ET MALWARE Ousaban Banker Server Response M2 |
rev 1 |
2021-10-25 |
| suricata |
ET MALWARE Ousaban Banker Checkin M1 |
rev 1 |
2021-10-25 |
| suricata |
ET MALWARE Ousaban Banker KeepAlive Response |
rev 1 |
2021-10-25 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 1 |
2021-10-25 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 1 |
2021-10-25 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 1 |
2021-10-25 |
| suricata |
ET HUNTING [@Silv0123] Possible Fake Microsoft Office User-Agent Observed |
rev 3 |
2021-10-25 |
| suricata |
ET MALWARE Ousaban Banker KeepAlive |
rev 1 |
2021-10-25 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 1 |
2021-10-25 |
| suricata |
ET PHISHING TodayZoo Phishing Kit GET M2 |
rev 2 |
2021-10-24 |
| suricata |
ET PHISHING TodayZoo Phishing Kit GET M1 |
rev 2 |
2021-10-24 |
| sigma |
Monero Crypto Coin Mining Pool Lookup |
stable |
2021-10-24 |
| snort |
ET TROJAN [CISA AA21-291A] Possible BlackMatter Ransomware Lateral Movement |
rev 2 |
2021-10-19 |
| snort |
ET TROJAN Trojan:Win32/Sabsik.FL.B!ml CnC Activity |
rev 2 |
2021-10-19 |
| suricata |
ET MALWARE [CISA AA21-291A] Possible BlackMatter Ransomware Lateral Movement |
rev 2 |
2021-10-19 |
| suricata |
ET MALWARE Trojan:Win32/Sabsik.FL.B!ml CnC Activity |
rev 1 |
2021-10-19 |
| snort |
ET TROJAN W32/Witch.3FA0!tr CnC Activity M2 |
rev 2 |
2021-10-18 |
| snort |
ET CURRENT_EVENTS Tech Support Scam - Windows Firewall M4 2021-08-17 |
rev 1 |
2021-10-17 |
| snort |
ET TROJAN Jasper URI Path Observed M1 |
rev 1 |
2021-10-17 |