| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-11-12 |
| snort |
ET TROJAN Win32/Retadup Success Response from CnC |
rev 3 |
2020-11-11 |
| snort |
ET TROJAN Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil |
rev 1 |
2020-11-11 |
| snort |
ET TROJAN Win32/CryptInject.BE!MTB Stealer CnC Checkin |
rev 4 |
2020-11-11 |
| snort |
ET INFO Wget Request for Executable |
rev 3 |
2020-11-11 |
| snort |
ET TROJAN Win32/Plurox Backdoor CnC Checkin |
rev 3 |
2020-11-11 |
| snort |
ET TROJAN Suspected Tunna Proxy M2 |
rev 3 |
2020-11-11 |
| snort |
ET EXPLOIT Possible WePresent WIPG1000 OS Command Injection |
rev 3 |
2020-11-11 |
| suricata |
ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M2 |
rev 3 |
2020-11-11 |
| suricata |
ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1 |
rev 3 |
2020-11-11 |
| suricata |
ET HUNTING Suspicious POST Request with Possible COVID-19 URI M2 |
rev 3 |
2020-11-11 |
| suricata |
ET HUNTING Suspicious POST Request with Possible COVID-19 URI M1 |
rev 3 |
2020-11-11 |
| suricata |
ET MALWARE Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil |
rev 1 |
2020-11-11 |
| suricata |
ET HUNTING Suspicious GET Request with Possible COVID-19 URI M1 |
rev 3 |
2020-11-11 |
| suricata |
ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M1 |
rev 3 |
2020-11-11 |
| suricata |
ET HUNTING Suspicious GET Request with Possible COVID-19 URI M2 |
rev 3 |
2020-11-11 |
| suricata |
ET MALWARE Win32/Plurox Backdoor CnC Checkin |
rev 4 |
2020-11-11 |
| snort |
ET POLICY DNS Lookup for Upaste Paste Site |
rev 2 |
2020-11-10 |
| snort |
ET CURRENT_EVENTS Likely Malicious Windows SCT Download MSXMLHTTP M3 |
rev 2 |
2020-11-10 |
| snort |
ET INFO GET to Puu.sh for TXT File with Minimal Headers |
rev 3 |
2020-11-10 |
| snort |
ET TROJAN JavaRAT CnC Init Activity |
rev 2 |
2020-11-10 |
| snort |
ET TROJAN [eSentire] VBS Retrieving Malicious Payload |
rev 3 |
2020-11-10 |
| snort |
ET CURRENT_EVENTS [eSentire] Successful 163 Webmail Phish 2018-07-25 |
rev 3 |
2020-11-10 |
| snort |
ET POLICY Possible winexe over SMB - Possible Lateral Movement |
rev 3 |
2020-11-10 |
| snort |
ET TROJAN JavaRAT Requesting Screen Size |
rev 3 |
2020-11-10 |
| snort |
ET TROJAN Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND |
rev 3 |
2020-11-10 |
| snort |
ET TROJAN Linkup Ransomware check-in |
rev 2 |
2020-11-10 |
| suricata |
ET EXPLOIT Possible Telerik UI CVE-2019-18935 File Upload Attempt M2 |
rev 2 |
2020-11-10 |
| suricata |
ET PHISHING Possible Successful COVID-19 Related Phish M2 |
rev 2 |
2020-11-10 |
| suricata |
ET INFO DNS Lookup for Upaste Paste Site |
rev 2 |
2020-11-10 |
| suricata |
ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND |
rev 4 |
2020-11-10 |
| suricata |
ET PHISHING Possible Successful COVID-19 Related Phish M1 |
rev 2 |
2020-11-10 |
| snort |
ET MALWARE Win32/Sogou.H Variant Request |
rev 2 |
2020-11-09 |
| snort |
ET TROJAN Pay2Key Ransomware - Sending RSA Key |
rev 2 |
2020-11-09 |
| suricata |
ET MALWARE Possible APT28 Phishing Domain in DNS Query |
rev 3 |
2020-11-09 |
| suricata |
ET MALWARE Possible APT28 Phishing Domain in DNS Query |
rev 3 |
2020-11-09 |
| suricata |
ET MALWARE Pay2Key Ransomware - Sending RSA Key |
rev 1 |
2020-11-09 |
| suricata |
ET MALWARE W32/Patchwork.Backdoor CnC Check-in M2 |
rev 5 |
2020-11-09 |
| suricata |
ET MALWARE Possible APT28 Phishing Domain in DNS Query |
rev 3 |
2020-11-09 |
| suricata |
ET MALWARE Possible APT28 Phishing Domain in DNS Query |
rev 3 |
2020-11-09 |