| suricata |
GPL NETBIOS SMB-DS IrotIsRunning unicode little endian attempt |
rev 5 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of document.write % Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 11 |
rev 2 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x02 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE JavaRAT Sending Screenshot |
rev 1 |
2019-07-26 |
| suricata |
ET P2P eMule KAD Network Server Status Request |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Suspected ExtraPulsar Backdoor |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS DCERPC IrotIsRunning attempt |
rev 4 |
2019-07-26 |
| suricata |
ET INFO Cryptocurrency Miner Checkin M2 |
rev 2 |
2019-07-26 |
| suricata |
ET SHELLCODE Rothenburg Shellcode |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Java/QRat Variant Checkin |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT Cisco Smart Install Exploitation Tool - ChangeConfig |
rev 1 |
2019-07-26 |
| suricata |
ET VOIP Modified Sipvicious Asterisk PBX User-Agent |
rev 2 |
2019-07-26 |
| suricata |
ET DOS Likely NTP DDoS In Progress Multiple UNSETTRAP Mode 6 Responses |
rev 4 |
2019-07-26 |
| suricata |
ET SCADA SEIG SYSTEM 9 - Remote Code Execution |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Adobe Reader and Acrobat U3D File Invalid Array Index Remote Code Execution Attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE MAGICHOUND.LEASH IRC CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB IrotIsRunning little endian attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL SHELLCODE AIX NOOP |
rev 7 |
2019-07-26 |
| suricata |
ET SCAN SIP erase_registrations/add registrations attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB IrotIsRunning unicode little endian attempt |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Carbanak APT CnC Beacon 2 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE LuminosityLink - Data Channel Client Request |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT Equation Group ExtraBacon Cisco ASA AAAADMINAUTH Disable |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Possible %u UTF-8 Encoded Iframe Tag |
rev 2 |
2019-07-26 |
| suricata |
ET P2P Ares Server Connection |
rev 3 |
2019-07-26 |
| suricata |
GPL ICMP PING Seer Windows |
rev 8 |
2019-07-26 |
| suricata |
ET SCAN ICMP Delphi Likely Precursor to Scan |
rev 3 |
2019-07-26 |
| suricata |
ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB InitiateSystemShutdown attempt |
rev 6 |
2019-07-26 |
| suricata |
GPL SCAN PING Delphi-Piette Windows |
rev 8 |
2019-07-26 |
| suricata |
GPL RPC xdmcp info query |
rev 2 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Microsoft CScript Banner Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET INFO PTUNNEL INBOUND |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Mashigoom/Tranwos/RevProxy ClickFraud - hello |
rev 6 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE SysInternals sc.exe Output Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT bin bash base64 encoded Remote Code Execution 1 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Black Stealer Exfil FTP STOR |
rev 1 |
2019-07-26 |
| suricata |
ET INFO LLNMR query response to wpad |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 1 |
rev 2 |
2019-07-26 |