| suricata |
ET INFO PTUNNEL INBOUND |
rev 3 |
2019-07-26 |
| suricata |
ET EXPLOIT bin bash base64 encoded Remote Code Execution 1 |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB C$ unicode share access |
rev 12 |
2019-07-26 |
| suricata |
ET DOS DNS Amplification Attack Inbound |
rev 8 |
2019-07-26 |
| suricata |
ET MALWARE Windows WMIC NIC get Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET INFO LLNMR query response to wpad |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Linux/BillGates Checkin |
rev 1 |
2019-07-26 |
| suricata |
ET DOS Likely NTP DDoS In Progress PEER_LIST_SUM Response to Non-Ephemeral Port IMPL 0x03 |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Java/QRat Variant Checkin |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Windows Microsoft Windows DOS prompt command Error Invalid Argument |
rev 1 |
2019-07-26 |
| suricata |
ET SHELLCODE Rothenburg Shellcode |
rev 3 |
2019-07-26 |
| suricata |
ET INFO Cisco Smart Install Protocol Observed |
rev 1 |
2019-07-26 |
| suricata |
GPL SCAN PING Delphi-Piette Windows |
rev 8 |
2019-07-26 |
| suricata |
ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Possible %u UTF-16 Encoded Iframe Tag |
rev 2 |
2019-07-26 |
| suricata |
ET P2P eMule KAD Network Firewalled Request |
rev 4 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE SysInternals sc.exe Output Outbound |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Possible WMI .mof Managed Object File Use Over SMB |
rev 2 |
2019-07-26 |
| suricata |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Exploited Message |
rev 3 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Microsoft CScript Banner Outbound |
rev 1 |
2019-07-26 |
| suricata |
GPL RPC xdmcp info query |
rev 2 |
2019-07-26 |
| suricata |
ET P2P eMule KAD Network Server Status Request |
rev 4 |
2019-07-26 |
| suricata |
ET WEB_CLIENT Possible # Encoded Iframe Tag |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Email Contains wininet.dll Call - Potentially Dridex MalDoc 1 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE W32/SCKeyLog.InfoStealer Installation Confirmation Via SMTP |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN SIP erase_registrations/add registrations attempt |
rev 5 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB CoGetInstanceFromFile overflow attempt |
rev 4 |
2019-07-26 |
| suricata |
GPL SHELLCODE AIX NOOP |
rev 7 |
2019-07-26 |
| suricata |
ET SCAN ICMP Delphi Likely Precursor to Scan |
rev 3 |
2019-07-26 |
| suricata |
ET SCAN Port Unreachable Response to Xprobe2 OS Fingerprint Scan |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Windows WMIC STARTUP get Microsoft Windows DOS prompt command exit OUTBOUND |
rev 1 |
2019-07-26 |
| suricata |
ET INFO Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] Remcos RAT Checkin 26 |
rev 1 |
2019-07-26 |
| suricata |
ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC No Open Ports Message |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT Equation Group ExtraBacon Cisco ASA PMCHECK Disable |
rev 1 |
2019-07-26 |
| suricata |
ET EXPLOIT php script base64 encoded Remote Code Execution 3 |
rev 2 |
2019-07-26 |
| suricata |
ET SCAN Sivus VOIP Vulnerability Scanner SIP Scan |
rev 4 |
2019-07-26 |
| suricata |
ET EXPLOIT ETERNALBLUE Exploit M2 MS17-010 |
rev 2 |
2019-07-26 |
| suricata |
GPL NETBIOS SMB-DS RemoteActivation attempt |
rev 4 |
2019-07-26 |
| suricata |
ET MALWARE Tsyrval Panda CnC Beacon |
rev 1 |
2019-07-26 |