| snort |
ET USER_AGENTS Node XMLHTTP User-Agent |
rev 2 |
2019-05-28 |
| snort |
ET TROJAN Win32/ProtonBot Stealer Activity |
rev 2 |
2019-05-28 |
| snort |
ET TROJAN Observed ProtonBot User-Agent |
rev 2 |
2019-05-28 |
| snort |
ET POLICY Possible EXE Download Request to ngrok |
rev 2 |
2019-05-28 |
| snort |
ET TROJAN Observed DNS Query to APT10 Related CnC Domain |
rev 2 |
2019-05-28 |
| snort |
ET CURRENT_EVENTS JS ShellWindows/AddInProcess Win10 DeviceGuardBypass Inbound |
rev 2 |
2019-05-24 |
| snort |
ET CURRENT_EVENTS Possible Router EK Landing Page Inbound 2019-05-24 |
rev 2 |
2019-05-24 |
| snort |
ET TROJAN Shade Ransomware Payment Domain in DNS Lookup |
rev 2 |
2019-05-24 |
| snort |
ET TROJAN HTA.BabyShark HTTP Exfil |
rev 1 |
2019-05-24 |
| snort |
ET CURRENT_EVENTS Unknown VBScript Loader with Encoded PowerShell Execution Inbound |
rev 2 |
2019-05-23 |
| snort |
ET EXPLOIT Eir D1000 Remote Command Injection Attempt Outbound |
rev 2 |
2019-05-23 |
| snort |
ET EXPLOIT Eir D1000 Remote Command Injection Attempt Inbound |
rev 2 |
2019-05-23 |
| snort |
ET POLICY External IP Lookup - iplocation .truevue .org |
rev 2 |
2019-05-22 |
| snort |
ET TROJAN Suspected ExtraPulsar Backdoor |
rev 3 |
2019-05-22 |
| snort |
ET TROJAN Mirai Variant Checkin Response |
rev 1 |
2019-05-20 |
| snort |
ET EXPLOIT CyberArk Enterprise Password Vault XXE Injection Attempt |
rev 2 |
2019-05-16 |
| snort |
ET TROJAN MirrorThief CnC in DNS Lookup |
rev 2 |
2019-05-15 |
| snort |
ET TROJAN MirrorThief CnC Domain in DNS Lookup |
rev 3 |
2019-05-14 |
| snort |
ET TROJAN ELF.SystemdMiner C2 Domain in DNS Lookup |
rev 1 |
2019-05-13 |
| snort |
ET TROJAN MSIL/Almashreq Executing New Processes |
rev 2 |
2019-05-13 |
| snort |
ET TROJAN ELF.SystemdMiner C2 Domain in DNS Lookup |
rev 1 |
2019-05-13 |
| snort |
ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000 |
rev 2 |
2019-05-10 |
| snort |
ET WEB_SPECIFIC_APPS Jenkins Pre-auth User Information Leakage |
rev 2 |
2019-05-10 |
| snort |
ET WEB_SPECIFIC_APPS Jenkins Information Disclosure CVE-2017-1000395 |
rev 2 |
2019-05-10 |
| snort |
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2 |
rev 2 |
2019-05-10 |
| snort |
ET TROJAN Win32/ElectricFish Authentication Packet Observed |
rev 2 |
2019-05-09 |
| snort |
ET WEB_SERVER China Chopper WebShell Observed Outbound |
rev 2 |
2019-05-09 |
| snort |
ET CURRENT_EVENTS Possible JS Credit Card Stealer Inbound |
rev 2 |
2019-05-09 |
| snort |
ET CURRENT_EVENTS CSharp SMB Scanner Assembly in PowerShell Inbound M2 |
rev 2 |
2019-05-08 |
| snort |
ET CURRENT_EVENTS Wide HTA with PowerShell Execution Inbound |
rev 2 |
2019-05-08 |
| snort |
ET POLICY Inbound PowerShell Capable of Enumerating Internal Network via WMI |
rev 2 |
2019-05-08 |
| snort |
ET TROJAN PS/Unk.EB.Spreader CnC Checkin |
rev 2 |
2019-05-08 |
| snort |
ET CURRENT_EVENTS CSharp SMB Scanner Assembly in PowerShell Inbound M1 |
rev 2 |
2019-05-08 |
| snort |
ET POLICY Cryptocurrency Miner Checkin M2 |
rev 2 |
2019-05-06 |
| snort |
ET TROJAN Win32/Krypton Stealer CnC Checkin |
rev 2 |
2019-05-03 |
| snort |
ET TROJAN IcedID Fake Resume Server in DNS Lookup |
rev 2 |
2019-05-03 |
| snort |
ET TROJAN JAR/Qealler Stealer HTTP Headers Observed |
rev 2 |
2019-05-02 |
| snort |
ET TROJAN ServHelper CnC Domain |
rev 2 |
2019-05-01 |
| snort |
ET TROJAN ServHelper CnC Domain |
rev 2 |
2019-05-01 |
| snort |
ET TROJAN ServHelper CnC Domain |
rev 2 |
2019-05-01 |