| suricata |
ET HUNTING Windows nbtstat -r Microsoft Windows DOS prompt command exit OUTBOUND |
rev 2 |
2019-07-26 |
| suricata |
ET VOIP Modified Sipvicious Asterisk PBX User-Agent |
rev 2 |
2019-07-26 |
| suricata |
ET INFO Outgoing Chromoting Session Response |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Banker.Delf Infection - Sending Initial Email to Owner |
rev 8 |
2019-07-26 |
| suricata |
ET SCAN Amap UDP Service Scan Detected |
rev 2 |
2019-07-26 |
| suricata |
ET TFTP Outbound TFTP Data Transfer With Cisco Config 2 |
rev 2 |
2019-07-26 |
| suricata |
ET SCADA SEIG SYSTEM 9 - Remote Code Execution |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Windows nbtstat -a Microsoft Windows DOS prompt command exit OUTBOUND |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Adobe Reader and Acrobat U3D File Invalid Array Index Remote Code Execution Attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE CommentCrew Possible APT c2 communications html return 1 |
rev 3 |
2019-07-26 |
| suricata |
GPL TFTP GET passwd |
rev 5 |
2019-07-26 |
| suricata |
GPL IMAP authenticate overflow attempt |
rev 12 |
2019-07-26 |
| suricata |
GPL IMAP unsubscribe literal overflow attempt |
rev 2 |
2019-07-26 |
| suricata |
GPL CHAT Yahoo Messenger File Transfer Receive Request |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB OpenKey unicode overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET INFO PTUNNEL OUTBOUND |
rev 2 |
2019-07-26 |
| suricata |
ET P2P Limewire P2P UDP Traffic |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE [GIGAMON_ATR] FIN8 BADHATCH Remote Shell Banner |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Proxy - BurpSuite PortSwigger Proxy Certificate Seen |
rev 1 |
2019-07-26 |
| suricata |
ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String ILMI |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE OSX/Mami Possible DNS Query to Evil DNS Server |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Bitter RAT C2 Response |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN Suspicious inbound to Oracle SQL port 1521 |
rev 3 |
2019-07-26 |
| suricata |
GPL TFTP GET Admin.dll |
rev 5 |
2019-07-26 |
| suricata |
ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection |
rev 15 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS llsrconnect unicode overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS InitiateSystemShutdown attempt |
rev 10 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Possible MS CMD Shell opened on local system |
rev 9 |
2019-07-26 |
| suricata |
ET MALWARE UBoatRAT CnC Check-in |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Possible WMI .mof Managed Object File Use Over SMB |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Remcos RAT Checkin 85 |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB OpenKey overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 7 |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN StarDotStar HELO, suspected AUTH LOGIN botnet |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS NDdeSetTrustedShareW overflow attempt |
rev 6 |
2019-07-26 |
| suricata |
ET MALWARE Optix Pro Trojan/Keylogger Reporting Installation via Email |
rev 5 |
2019-07-26 |
| suricata |
ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE W32/Bakcorox.A ProxyBot CnC Server Connection |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Possible %u UTF-8 Encoded Iframe Tag |
rev 2 |
2019-07-26 |