| suricata |
ET WEB_SERVER WebShell Generic - ASP File Uploaded |
rev 12 |
2020-04-24 |
| suricata |
ET WEB_SERVER Leaf PHPMailer Accessed on Internal Server |
rev 1 |
2020-04-24 |
| suricata |
ET MALWARE W32/TCYWin.Downloader User-Agent |
rev 4 |
2020-04-24 |
| suricata |
ET MALWARE Suspicious User-Agent MyAgrent |
rev 4 |
2020-04-24 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on Compromised External Server |
rev 1 |
2020-04-24 |
| suricata |
ET EXPLOIT_KIT Watering Hole applet name AppletHigh.jar |
rev 5 |
2020-04-24 |
| suricata |
ET WEB_SERVER ColdFusion scheduleedit access |
rev 3 |
2020-04-24 |
| suricata |
ET WEB_SERVER WebShell - GODSPy - Auth Creds |
rev 3 |
2020-04-24 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on Compromised External Server |
rev 2 |
2020-04-24 |
| suricata |
ET WEB_SERVER WebShell - Pouya - URI - raiz |
rev 3 |
2020-04-24 |
| snort |
ET MALWARE Observed DNS Query to Malvertising Related Domain |
rev 2 |
2020-04-23 |
| snort |
ET TROJAN METALJACK APT32 CnC Host Checkin |
rev 2 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS TinyBrowser tinybrowser.php file Script Execution Attempt |
rev 4 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell - PHPShell - Haxplorer URI |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 1 |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER LOIC Javascript DDoS Inbound |
rev 6 |
2020-04-23 |
| suricata |
ET EXPLOIT Adobe PDF Zero Day Trojan.666 Payload libarhlp32.dll Second Stage Download POST |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE Gimemo Activity |
rev 5 |
2020-04-23 |
| suricata |
ET EXPLOIT_KIT Gondad Exploit Kit Post Exploitation Request |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Vundo.Downloader Reporting User Website Session Information |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE Linux/SSHDoor.A Reporting Backdoor CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET SCAN Core-Project Scanning Bot UA Detected |
rev 7 |
2020-04-23 |
| suricata |
ET MOBILE_MALWARE Android/Smsilence.A Successful Install Report |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32/DownloaderAgent.fajk Successful Infection CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell - MySQL Interface - Server Set Cookie mysql_web_admin*= |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Citadel Infection or Config URL Request |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS OSClass id parameter data access Attempt 2 |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE METALJACK APT32 CnC Host Checkin |
rev 2 |
2020-04-23 |
| suricata |
ET MALWARE W32/Citadel Conf.bin Download From CnC Server |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SERVER WebShell Generic - reg HKEY_LOCAL_MACHINE |
rev 3 |
2020-04-23 |
| suricata |
ET EXPLOIT Adobe PDF Zero Day Trojan.666 Payload libarext32.dll Second Stage Download POST |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32/Citadel Content.php CnC POST |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/FloatingCloud.Banker CnC Beacon |
rev 4 |
2020-04-23 |
| suricata |
ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning |
rev 3 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS TinyBrowser edit.php file Script Execution Attempt |
rev 3 |
2020-04-23 |
| suricata |
ET INFO POSSIBLE Crawl using Fetch |
rev 12 |
2020-04-23 |
| suricata |
ET WEB_SPECIFIC_APPS TinyBrowser upload.php file Script Execution Attempt |
rev 3 |
2020-04-23 |
| suricata |
ET MOBILE_MALWARE Android/Smsilence.A Sending SMS Messages CnC Beacon |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32/Citadel File.php CnC POST |
rev 3 |
2020-04-23 |
| suricata |
ET EXPLOIT_KIT DRIVEBY EgyPack Exploit Kit Cookie Present |
rev 5 |
2020-04-23 |