| snort |
ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound M2 |
rev 2 |
2020-03-31 |
| snort |
ET TROJAN Win32/Tofsee Malformed Spam Template String |
rev 2 |
2020-03-31 |
| snort |
ET EXPLOIT Possible Telerik UI CVE-2019-18935 File Upload Attempt M2 |
rev 2 |
2020-03-30 |
| snort |
ET EXPLOIT Possible Telerik UI CVE-2019-18935 File Upload Attempt M1 |
rev 2 |
2020-03-30 |
| snort |
ET TROJAN Observed Glupteba CnC Domain in TLS SNI |
rev 2 |
2020-03-30 |
| snort |
ET CURRENT_EVENTS Possible Successful COVID-19 Related Phish M2 |
rev 2 |
2020-03-29 |
| snort |
ET CURRENT_EVENTS Possible Successful COVID-19 Related Phish M1 |
rev 2 |
2020-03-29 |
| snort |
ET CURRENT_EVENTS Successful Airbnb COVID-19 Phish 2020-03-26 |
rev 2 |
2020-03-26 |
| suricata |
ET PHISHING Successful Airbnb COVID-19 Phish 2020-03-26 |
rev 2 |
2020-03-26 |
| snort |
ET POLICY File Uploaded to ge.tt Filesharing Service |
rev 2 |
2020-03-25 |
| snort |
ET CURRENT_EVENTS Successful Airbnb COVID-19 Phish 2020-03-25 |
rev 2 |
2020-03-25 |
| snort |
ET CURRENT_EVENTS Successful Colleagues Quarantined with COVID-19 Phish 2020-03-25 |
rev 2 |
2020-03-25 |
| suricata |
ET PHISHING Successful Airbnb COVID-19 Phish 2020-03-25 |
rev 2 |
2020-03-25 |
| snort |
ET WEB_CLIENT Microsoft Tech Support Scam 2020-03-24 |
rev 2 |
2020-03-24 |
| snort |
ET CURRENT_EVENTS Successful World Health Organization COVID-19 Phish 2020-03-23 |
rev 3 |
2020-03-24 |
| snort |
ET TROJAN Win32/RaaLoader CnC Activity |
rev 1 |
2020-03-24 |
| suricata |
ET MALWARE Win32/RaaLoader CnC Activity |
rev 1 |
2020-03-24 |
| suricata |
ET WEB_CLIENT Microsoft Tech Support Scam 2020-03-24 |
rev 2 |
2020-03-24 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET CURRENT_EVENTS UK GOV Identity Verification Phishing Landing |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN CoreDDRAT Initial Checkin |
rev 2 |
2020-03-23 |
| snort |
ET CURRENT_EVENTS Successful NHS Webmail Phish 2020-03-23 |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN CoreDDRAT Screenshot Exfil |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN Possible APT28 Phishing Domain in DNS Query |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN CoreDDRAT KeepAlive Message |
rev 2 |
2020-03-23 |
| snort |
ET TROJAN CoreDDRAT CnC Activity |
rev 1 |
2020-03-23 |
| suricata |
ET PHISHING Successful NHS Webmail Phish 2020-03-23 |
rev 2 |
2020-03-23 |
| suricata |
ET HUNTING Observed Lets Encrypt Certificate - Possible COVID-19 Related M2 |
rev 2 |
2020-03-23 |
| suricata |
ET PHISHING UK GOV Identity Verification Phishing Landing |
rev 2 |
2020-03-23 |
| suricata |
ET HUNTING Observed Lets Encrypt Certificate - Possible COVID-19 Related M1 |
rev 2 |
2020-03-23 |
| suricata |
ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1 |
rev 2 |
2020-03-23 |
| suricata |
ET MALWARE CoreDDRAT Initial Checkin |
rev 1 |
2020-03-23 |
| suricata |
ET MALWARE CoreDDRAT CnC Activity |
rev 1 |
2020-03-23 |