| snort |
ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server |
rev 2 |
2020-11-04 |
| snort |
ET TROJAN W32/Kimsuky Sending Encrypted System Information to CnC |
rev 5 |
2020-11-04 |
| snort |
ET TROJAN Kimsuky KGH Backdoor CnC Activity M2 |
rev 2 |
2020-11-04 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-11-04 |
| snort |
ET TROJAN Kimsuky WildCommand CnC Activity |
rev 2 |
2020-11-04 |
| snort |
ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server |
rev 2 |
2020-11-04 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-11-04 |
| suricata |
ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server |
rev 2 |
2020-11-04 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-11-04 |
| suricata |
ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server |
rev 2 |
2020-11-04 |
| suricata |
ET MALWARE W32/Kimsuky Sending Encrypted System Information to CnC |
rev 5 |
2020-11-04 |
| suricata |
ET MALWARE Kimsuky WildCommand CnC Activity |
rev 1 |
2020-11-04 |
| suricata |
ET MALWARE Kimsuky KGH Backdoor CnC Activity M2 |
rev 1 |
2020-11-04 |
| suricata |
ET WEB_SPECIFIC_APPS GitList Argument Injection |
rev 3 |
2020-11-04 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-11-04 |
| snort |
ET TROJAN Kimsuky KGH Malware Suite Checkin M2 |
rev 2 |
2020-11-03 |
| snort |
ET USER_AGENTS Suspicious HttpSocket User-Agent Observed |
rev 2 |
2020-11-03 |
| snort |
ET TROJAN Kimsuky CSPY Downloader Activity |
rev 2 |
2020-11-03 |
| snort |
ET TROJAN Kimsuky KGH Malware Suite Checkin M1 |
rev 2 |
2020-11-03 |
| suricata |
ET MALWARE Kimsuky KGH Malware Suite Checkin M2 |
rev 1 |
2020-11-03 |
| suricata |
ET MALWARE Kimsuky KGH Malware Suite Checkin M1 |
rev 1 |
2020-11-03 |
| suricata |
ET MALWARE BlackTech ELF/TSCookie CnC Observed in DNS Query |
rev 3 |
2020-11-03 |
| suricata |
ET MALWARE BlackTech ELF/TSCookie CnC Observed in DNS Query |
rev 3 |
2020-11-03 |
| snort |
ET TROJAN Trickbot Anchor ICMP Request |
rev 1 |
2020-11-02 |
| snort |
ET TROJAN D1onis Stealer Sending Data to CnC |
rev 2 |
2020-11-02 |
| suricata |
ET WEB_SPECIFIC_APPS PHP-Nuke SQL Injection Attempt -- modules.php pid INSERT |
rev 8 |
2020-11-02 |
| suricata |
ET WEB_SPECIFIC_APPS Coppermine Photo Gallery SQL Injection Attempt -- usermgr.php gid DELETE |
rev 10 |
2020-11-02 |
| suricata |
ET WEB_SPECIFIC_APPS DMXReady Secure Login Manager SQL Injection Attempt -- members.asp sent UPDATE |
rev 10 |
2020-11-02 |
| suricata |
ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style SELECT |
rev 10 |
2020-11-02 |
| suricata |
ET MALWARE Hacking Team Elite Windows Implant Exfiltration |
rev 9 |
2020-11-02 |
| suricata |
ET WEB_SPECIFIC_APPS ASPMForum SQL Injection Attempt -- mesajkutum.asp mesajno DELETE |
rev 10 |
2020-11-02 |
| suricata |
ET MALWARE Trickbot Anchor ICMP Request |
rev 1 |
2020-11-02 |
| suricata |
ET MALWARE Hacking Team Scout Windows Implant Exfiltration |
rev 10 |
2020-11-02 |
| suricata |
ET WEB_SPECIFIC_APPS The Address Book SQL Injection Attempt -- user.php passwordNew UNION SELECT |
rev 10 |
2020-11-02 |
| suricata |
ET MALWARE Win32/Sisron/BackDoor.Cybergate.1 Checkin |
rev 11 |
2020-11-02 |
| snort |
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Fuzzing Inbound M1 |
rev 2 |
2020-10-30 |
| snort |
ET TROJAN Win32/Ymacco.AA67 CnC Activity |
rev 2 |
2020-10-30 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Fuzzing Inbound M1 |
rev 1 |
2020-10-30 |
| suricata |
ET PHISHING Suspected Appspot Hosted Phishing Domain |
rev 2 |
2020-10-30 |
| suricata |
ET WEB_SPECIFIC_APPS Possible Oracle WebLogic RCE Fuzzing Inbound M2 |
rev 1 |
2020-10-30 |