| snort |
ET TROJAN Lunar Builder Exfil Response |
rev 2 |
2021-07-27 |
| suricata |
ET MALWARE Lunar Builder Exfil via Discord M2 |
rev 2 |
2021-07-27 |
| suricata |
ET PHISHING Observed DNS Query to Known Scam/Phishing Domain |
rev 1 |
2021-07-27 |
| suricata |
ET HUNTING Screenshot Uploaded to Discord |
rev 1 |
2021-07-27 |
| suricata |
ET MALWARE 44Calibar Variant Exfil via Telegram |
rev 1 |
2021-07-27 |
| snort |
ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Config URL |
rev 1 |
2021-07-26 |
| snort |
ET TROJAN W32/Echmark/MarkiRAT CnC Activity M3 |
rev 1 |
2021-07-26 |
| snort |
ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Config |
rev 1 |
2021-07-26 |
| snort |
ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Admin Cores |
rev 1 |
2021-07-26 |
| snort |
ET TROJAN Anchor_DNS stickseed Variant CnC Checkin |
rev 2 |
2021-07-26 |
| snort |
ET TROJAN Observed Malsmoke Staging Domain in SNI |
rev 1 |
2021-07-26 |
| suricata |
ET HUNTING NOP Sled in HTTP Header Inbound - Possible Exploit Activity |
rev 1 |
2021-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Admin Cores |
rev 1 |
2021-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Config |
rev 1 |
2021-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS Solr DataImport Handler Disclose Config URL |
rev 1 |
2021-07-26 |
| suricata |
ET MALWARE Anchor_DNS stickseed Variant CnC Checkin |
rev 2 |
2021-07-26 |
| snort |
ET CURRENT_EVENTS Webshell Landing Outbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| snort |
ET TROJAN RustyBuer CnC Domain in SNI |
rev 1 |
2021-07-25 |
| snort |
ET TROJAN Dmechant Exfil Passwords via SMTP |
rev 2 |
2021-07-25 |
| snort |
ET TROJAN Dmechant Exfil Cryptowallets via SMTP |
rev 2 |
2021-07-25 |
| snort |
ET CURRENT_EVENTS Webshell Access with Known Password Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| snort |
ET CURRENT_EVENTS Webshell Upload Command Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| snort |
ET CURRENT_EVENTS Webshell Execute Command Inbound - Possibly Iran-based M1 |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Dmechant Exfil Passwords via SMTP |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Dmechant Exfil Cryptowallets via SMTP |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Webshell Upload Command Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Webshell Execute Command Inbound - Possibly Iran-based M1 |
rev 1 |
2021-07-25 |
| suricata |
ET MALWARE Webshell Access with Known Password Inbound - Possibly Iran-based |
rev 1 |
2021-07-25 |
| snort |
ET EXPLOIT Cisco Data Center Network Manager Information Disclosure Inbound |
rev 1 |
2021-07-24 |
| suricata |
ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity |
rev 2 |
2021-07-24 |
| suricata |
ET EXPLOIT Cisco Data Center Network Manager Information Disclosure Inbound |
rev 1 |
2021-07-24 |
| suricata |
ET HUNTING .exec in HTTP Header Inbound - Possible Exploit Activity |
rev 2 |
2021-07-24 |
| snort |
ET TROJAN KPOT Stealer Initial CnC Activity M5 |
rev 1 |
2021-07-23 |
| suricata |
ET JA3 Hash - Possible Cobalt Strike Server |
rev 1 |
2021-07-23 |
| suricata |
ET JA3 Hash - Possible Cobalt Strike Server |
rev 1 |
2021-07-23 |
| snort |
ET MALWARE Win32/TrojanDownloader.Agent.BXA CnC Activity |
rev 1 |
2021-07-22 |
| snort |
ET TROJAN BOUNCEBEAM Backdoor CnC Activity |
rev 1 |
2021-07-22 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncInstallPrinterDriverFromPackage |
rev 3 |
2021-07-20 |
| snort |
ET INFO DYNAMIC_DNS Query to freemyip .com Domain |
rev 2 |
2021-07-20 |
| snort |
ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncUploadPrinterDriverPackage |
rev 3 |
2021-07-20 |