| suricata |
ET P2P Limewire P2P UDP Traffic |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE Java/QRat Checkin |
rev 1 |
2019-07-26 |
| suricata |
GPL SHELLCODE HP-UX NOOP |
rev 7 |
2019-07-26 |
| suricata |
ET DOS Possible SSDP Amplification Scan in Progress |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Microsoft TEREDO IPv6 tunneling |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS DCERPC Workstation Service direct service access attempt |
rev 7 |
2019-07-26 |
| suricata |
ET MALWARE NetWire / Ozone / Darktrack Alien RAT - Server Hello |
rev 6 |
2019-07-26 |
| suricata |
GPL RPC portmap rstatd request UDP |
rev 10 |
2019-07-26 |
| suricata |
GPL ICMP PING WhatsupGold Windows |
rev 6 |
2019-07-26 |
| suricata |
GPL EXPLOIT kadmind buffer overflow attempt |
rev 9 |
2019-07-26 |
| suricata |
ET HUNTING Possible Powershell .ps1 Script Use Over SMB |
rev 2 |
2019-07-26 |
| suricata |
ET DOS Likely NTP DDoS In Progress GET_RESTRICT Response to Non-Ephemeral Port IMPL 0x02 |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Egspy Infection Report Email |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Windows WMIC SYSACCOUNT get Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP Data Transfer |
rev 3 |
2019-07-26 |
| suricata |
GPL RPC STATD UDP stat mon_name format string exploit attempt |
rev 11 |
2019-07-26 |
| suricata |
ET SCADA SEIG Modbus 3.4 - Remote Code Execution |
rev 1 |
2019-07-26 |
| suricata |
GPL IMAP login buffer overflow attempt |
rev 16 |
2019-07-26 |
| suricata |
ET EXPLOIT Oracle Weblogic Server Deserialization Remote Command Execution |
rev 1 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Cisco TclShell TFTP Download |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB RemoteActivation unicode attempt |
rev 4 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Weak Netbios Lanman Auth Challenge Detected |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE Py/MechaFlounder CnC Activity - Reporting Download Command Success |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 1 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE ELF.MrBlack DOS.TF Variant |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Enchanim C2 Injection Download |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS llsrconnect little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET INFO Possible Kali Linux hostname in DHCP Request Packet |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS DCERPC Messenger Service buffer overflow attempt |
rev 10 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS llsrconnect unicode little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack |
rev 9 |
2019-07-26 |
| suricata |
ET COINMINER W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Initial Connection Server Response |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE US-CERT TA14-353A Wiper 2 |
rev 1 |
2019-07-26 |
| suricata |
ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 - Known Exploit Instance |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE LURK Trojan Communication Protocol detected |
rev 3 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x03 |
rev 2 |
2019-07-26 |
| suricata |
ET DOS Likely NTP DDoS In Progress MON_LIST Response to Non-Ephemeral Port IMPL 0x02 |
rev 3 |
2019-07-26 |
| suricata |
ET INFO Ipconfig Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET P2P Edonkey Publicize File ACK |
rev 3 |
2019-07-26 |
| suricata |
ET SCAN Rapid IMAPS Connections - Possible Brute Force Attack |
rev 10 |
2019-07-26 |