| suricata |
ET MALWARE Volatile Cedar Win32.Explosive CnC Beacon 3 |
rev 1 |
2019-07-26 |
| suricata |
ET HUNTING SUSPICIOUS IRC - NICK and 3 Letter Country Code |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Termite Agent Implant CnC Checkin |
rev 2 |
2019-07-26 |
| suricata |
ET P2P TOR 1.0 Inbound Circuit Traffic |
rev 5 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 1 |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC portmap status request UDP |
rev 9 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation unicode attempt |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Denisca.A CnC Beacon 2 |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN H.323 Scanning device |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS ADMIN$ share access |
rev 9 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 12 |
rev 2 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x03 |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of String.fromCharCode % Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Windows nbtstat -n Microsoft Windows DOS prompt command exit OUTBOUND |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Win32/ElectricFish Authentication Packet Observed |
rev 2 |
2019-07-26 |
| suricata |
GPL SHELLCODE x86 0x71FB7BAB NOOP unicode |
rev 3 |
2019-07-26 |
| suricata |
ET INFO Office Document Containing AutoExec Macro Via smtp |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL ATTACK_RESPONSE id check returned root |
rev 7 |
2019-07-26 |
| suricata |
GPL RPC portmap ypserv request UDP |
rev 13 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS e107 CMS backdoor access admin-access cookie and HTTP POST |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Windows quser Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET HUNTING SUSPICIOUS SMTP Attachment Inbound PPT attachment with Embedded OLE Object M4 |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Linux/ChinaZ DDoS Bot Checkin |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian attempt |
rev 4 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x02 |
rev 3 |
2019-07-26 |
| suricata |
ET INFO SMB NT Create AndX Request For an Executable File |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT Exim Internet Mailer Remote Code Execution |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Mambo Scanning Message |
rev 2 |
2019-07-26 |
| suricata |
ET P2P BitTorrent DHT ping request |
rev 3 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible Microsoft RDP Client for Mac RCE |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Phorpiex Template 4 Active - Outbound Malicious Email Spam |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Suspicious inbound to MSSQL port 1433 |
rev 3 |
2019-07-26 |
| suricata |
ET COINMINER W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Connection |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NT Trans NT CREATE unicode DACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET ACTIVEX SoftCab Sound Converter ActiveX SaveFormat File overwrite Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 1 |
rev 8 |
2019-07-26 |
| suricata |
ET SCAN Multiple FTP Root Login Attempts from Single Source - Possible Brute Force Attempt |
rev 3 |
2019-07-26 |