| suricata |
ET INFO POSSIBLE Web Crawl using Curl |
rev 11 |
2020-10-19 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-10-19 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-10-19 |
| suricata |
ET MALWARE NSO Group Pegasus CnC Domain Observed in DNS Query |
rev 2 |
2020-10-19 |
| suricata |
ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server |
rev 2 |
2020-10-19 |
| suricata |
ET MALWARE NSO Group Pegasus CnC Domain Observed in DNS Query |
rev 2 |
2020-10-19 |
| suricata |
ET MALWARE NSO Group Pegasus CnC Domain Observed in DNS Query |
rev 2 |
2020-10-19 |
| suricata |
ET MALWARE APT 41 CnC Domain Observed in DNS Query |
rev 3 |
2020-10-19 |
| suricata |
ET MALWARE APT 41 CnC Domain Observed in DNS Query |
rev 3 |
2020-10-19 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Web.App Hosted Phish 2020-10-14 |
rev 2 |
2020-10-14 |
| snort |
ET CURRENT_EVENTS Successful Chase Phish 2020-10-14 |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-10-14 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-10-14 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN StormKitty Exfil via AnonFiles |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN Likely Malware CnC Hosted on 000webhostapp - POST to gate.php |
rev 2 |
2020-10-14 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-10-14 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN Observed IcedID CnC Domain in TLS SNI |
rev 2 |
2020-10-14 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-10-14 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-10-14 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-10-14 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-10-14 |
| suricata |
ET MALWARE WEBC2-TABLE Checkin 1 - APT1 Related |
rev 7 |
2020-10-14 |
| suricata |
ET MALWARE WEBC2-TABLE Checkin 2 - APT1 Related |
rev 4 |
2020-10-14 |
| suricata |
ET MALWARE WEBC2-TABLE Checkin 3 - APT1 Related |
rev 4 |
2020-10-14 |
| suricata |
ET MALWARE Likely Malware CnC Hosted on 000webhostapp - POST to gate.php |
rev 2 |
2020-10-14 |
| snort |
ET TROJAN StormKitty Data Exfil via Telegram |
rev 2 |
2020-10-13 |
| snort |
ET POLICY BSSID Location Lookup via api .mylnikov .org |
rev 2 |
2020-10-13 |
| snort |
ET CURRENT_EVENTS Microsoft Account Login Hosted on Firebasestorage |
rev 2 |
2020-10-13 |
| snort |
ET CURRENT_EVENTS Chase Phish Landing 2020-10-13 |
rev 2 |
2020-10-13 |
| snort |
ET TROJAN PoetRAT CnC Domain in DNS Lookup |
rev 2 |
2020-10-13 |
| snort |
ET CURRENT_EVENTS Amazon Phishing Landing 2020-10-13 |
rev 2 |
2020-10-13 |
| snort |
ET CURRENT_EVENTS Instagram Phishing Landing 2020-10-13 |
rev 2 |
2020-10-13 |
| suricata |
ET INFO BSSID Location Lookup via api .mylnikov .org |
rev 1 |
2020-10-13 |
| suricata |
ET MALWARE CASHY200 CnC Domain in DNS Lookup |
rev 3 |
2020-10-13 |
| suricata |
ET MALWARE DonotGroup CnC Domain Observed in DNS Query |
rev 2 |
2020-10-13 |