| suricata |
GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL ICMP PING Seer Windows |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE Windows nbtstat -n Microsoft Windows DOS prompt command exit OUTBOUND |
rev 2 |
2019-07-26 |
| suricata |
GPL ICMP PING Network Toolbox 3 Windows |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE MSIL/Golroted.B Keylogger FTP |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Py/MechaFlounder CnC Activity - Reporting Directory Change Command Success |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC portmap amountd request UDP |
rev 9 |
2019-07-26 |
| suricata |
ET MALWARE SC-KeyLog Keylogger Installed - Sending Initial Email Report |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE W32/iGrabber Info Stealer FTP Upload |
rev 3 |
2019-07-26 |
| suricata |
ET EXPLOIT php script double base64 encoded Remote Code Execution 9 |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET SCAN DCERPC rpcmgmt ifids Unauthenticated BIND |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains wininet.dll Call - Potentially Dridex MalDoc 2 |
rev 2 |
2019-07-26 |
| suricata |
ET EXPLOIT Possible Cisco IKEv1 Information Disclosure Vulnerability CVE-2016-6415 |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Proxy - OWASP Zed Attack Proxy Certificate Seen |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Behavioral Unusual Port 137 traffic Potential Scan or Infection |
rev 15 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB NT Trans NT CREATE SACL overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 10 |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT HID VertX and Edge door controllers command_blink_on Remote Command Execution |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC portmap cmsd request UDP |
rev 9 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS llsrconnect little endian overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of charCodeAt %u UTF-16 Encoding |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 1 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Kriptovor SMTP Traffic |
rev 1 |
2019-07-26 |
| suricata |
ET SCAN Suspicious inbound to MSSQL port 1433 |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB llsrconnect unicode little endian overflow attempt |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Linux/KDefend Checkin |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Perl/Shellbot.SM IRC CnC Checkin |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC portmap proxy attempt UDP |
rev 7 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] DorkBot.Downloader CnC Beacon |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile little endian attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS llsrconnect overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Skeleton Key Filename in SMB2 Traffic |
rev 4 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Hex Obfuscation of charCodeAt %u UTF-8 Encoding |
rev 2 |
2019-07-26 |
| suricata |
GPL RPC portmap SET attempt UDP 111 |
rev 6 |
2019-07-26 |
| suricata |
ET INFO SMB NT Create AndX Request For an Executable File |
rev 2 |
2019-07-26 |
| suricata |
ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x03 |
rev 3 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS Session Setup NTMLSSP unicode asn1 overflow attempt |
rev 7 |
2019-07-26 |
| suricata |
ET HUNTING SUSPICIOUS IRC - NICK and Win |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Phorpiex Template 4 Active - Outbound Malicious Email Spam |
rev 1 |
2019-07-26 |