| suricata |
ET INFO Protocol 41 IPv6 encapsulation potential 6in4 IPv6 tunnel active |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE CommentCrew Possible APT c2 communications get system |
rev 4 |
2019-07-26 |
| suricata |
ET DOS Likely NTP DDoS In Progress MON_LIST Response to Non-Ephemeral Port IMPL 0x02 |
rev 3 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x03 |
rev 3 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of arguments.callee % Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET FTP Possible FTP Daemon Username UPDATE SET SQL Injection Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode attempt |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Predator Pain Keylogger FTP |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown unicode attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE Linux/KDefend Checkin |
rev 3 |
2019-07-26 |
| suricata |
ET P2P Kazaa over UDP |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Skeleton Key Filename in SMB2 Traffic |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 2 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE SC-KeyLog Keylogger Installed - Sending Log Email Report |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 5 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO SMB2 NT Create AndX Request For an Executable File |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible Microsoft RDP Client for Mac RCE |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE P2P Zeus or ZeroAccess Request To CnC |
rev 9 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB llsrconnect unicode overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET EXPLOIT Exim Internet Mailer Remote Code Execution |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian attempt |
rev 4 |
2019-07-26 |
| suricata |
ET INFO SMB NT Create AndX Request For an Executable File |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT php script base64 encoded Remote Code Execution 1 |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS PerlBot Version Message |
rev 2 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Microsoft WMIC Prompt Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET NETBIOS Microsoft Windows Server 2003 Active Directory Pre-Auth BROWSER ELECTION Heap Overflow Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL EXPLOIT Microsoft cmd.exe banner |
rev 7 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Proxy - OWASP Zed Attack Proxy Certificate Seen |
rev 1 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Microsoft Netsh Firewall Disable Output Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN HTExploit Method |
rev 2 |
2019-07-26 |
| suricata |
GPL SCAN PING Sniffer Pro/NetXRay network scan |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Skeleton Key Filename in SMB2 Traffic |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ShellshockCampaign.DDOSBot Terminate Process CnC Server Message |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains wininet.dll Call - Potentially Dridex MalDoc 2 |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Command Shell Activity Over SMB - Possible Lateral Movement |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT NB8-04 - Possible Unauthed RCE via whitelist bypass |
rev 1 |
2019-07-26 |
| suricata |
GPL ICMP PING Ping-O-MeterWindows |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE Py/MechaFlounder CnC Activity - Reporting Sleep Command Success |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation unicode little endian attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL TFTP MISC TFTP32 Get Format string attempt |
rev 3 |
2019-07-26 |