| snort |
ET CURRENT_EVENTS Successful Craigslist Phish 2016-07-11 |
rev 4 |
2020-08-07 |
| snort |
ET MALWARE DownLoadAdmin Activity |
rev 2 |
2020-08-07 |
| suricata |
ET MALWARE Suspected Lockscreen Ransomware Activity |
rev 1 |
2020-08-07 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-08-06 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-08-06 |
| snort |
ET CURRENT_EVENTS Paypal Phishing Landing Feb 24 2017 |
rev 2 |
2020-08-06 |
| snort |
ET CURRENT_EVENTS Wells Fargo Phishing Landing 2018-02-02 M4 |
rev 3 |
2020-08-06 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-08-06 |
| snort |
ET CURRENT_EVENTS Possible Wells Fargo Phishing Landing - Title over non SSL |
rev 3 |
2020-08-06 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-08-06 |
| suricata |
ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan |
rev 7 |
2020-08-06 |
| suricata |
ET SCAN Suspicious User-Agent Containing Web Scan/er Likely Web Scanner |
rev 7 |
2020-08-06 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-08-06 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-08-06 |
| suricata |
ET SCAN Suspicious User-Agent Containing SQL Inject/ion Likely SQL Injection Scanner |
rev 8 |
2020-08-06 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-08-06 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-08-06 |
| snort |
ET TROJAN Unknown AutoIt Bot - Initial Server Response |
rev 1 |
2020-08-05 |
| snort |
ET TROJAN YAHOOYLO Stealer CnC Exfil |
rev 2 |
2020-08-05 |
| suricata |
ET MALWARE YAHOOYLO Stealer CnC Exfil |
rev 1 |
2020-08-05 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed |
rev 1 |
2020-08-05 |
| suricata |
ET MALWARE Possible DANDERSPRITZ HTTP Beacon |
rev 3 |
2020-08-05 |
| suricata |
ET MALWARE Unknown AutoIt Bot - Initial Server Response |
rev 1 |
2020-08-05 |
| suricata |
ET WEB_CLIENT HTA File Download Flowbit Set |
rev 3 |
2020-08-05 |
| suricata |
ET WEB_SERVER Generic Webshell Activity |
rev 1 |
2020-08-05 |
| snort |
ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL |
rev 2 |
2020-08-04 |
| snort |
ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL |
rev 3 |
2020-08-04 |
| snort |
ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL |
rev 2 |
2020-08-04 |
| snort |
ET CURRENT_EVENTS Phishing Landing via Tripod.com Mar 31 M3 |
rev 3 |
2020-08-04 |
| snort |
ET CURRENT_EVENTS Possible Facebook Phishing Landing - Title over non SSL |
rev 4 |
2020-08-04 |
| suricata |
ET WORM Possible Worm Sohanad.Z or Other Infection Request for setting.nql |
rev 5 |
2020-08-04 |
| suricata |
ET MALWARE MAGICHOUND.RETRIEVER CnC Beacon |
rev 3 |
2020-08-04 |
| suricata |
ET MALWARE CozyCar CnC Beacon |
rev 3 |
2020-08-04 |
| suricata |
ET JA3 Hash - Possible InnocenceBot CnC |
rev 1 |
2020-08-04 |
| suricata |
ET INFO Possible ProxyShell Anonymous Access Connection |
rev 5 |
2020-08-04 |
| suricata |
ET INFO IP Lookup Geoip.co.uk |
rev 3 |
2020-08-04 |
| suricata |
ET INFO Possible ProxyShell Hide IP Installation file download |
rev 5 |
2020-08-04 |
| suricata |
ET MALWARE W32/UltimateDefender.FakeAV Checkin |
rev 4 |
2020-08-04 |
| suricata |
ET EXPLOIT_KIT Fragus Exploit jar Download |
rev 4 |
2020-08-04 |
| snort |
ET CURRENT_EVENTS Possible iCloud Phishing Landing - Title over non SSL |
rev 2 |
2020-08-03 |