| snort |
ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Tunneled RDP Handshake |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement |
rev 1 |
2019-04-11 |
| snort |
ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement |
rev 2 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement |
rev 1 |
2019-04-10 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN DNS Query for Known Malicious Domain Observed Serving Various Phish Campaigns |
rev 2 |
2019-04-05 |
| snort |
ET TROJAN AHK/BKDR_HTV.ZKGD-A CnC Checkin |
rev 2 |
2019-04-04 |
| snort |
ET ATTACK_RESPONSE LaZagne Artifact Outbound in FTP |
rev 1 |
2019-04-04 |
| snort |
ET MOBILE_MALWARE Android/BasBanke CnC Checkin |
rev 2 |
2019-04-04 |
| snort |
ET EXPLOIT Linksys E-Series Device RCE Attempt Outbound |
rev 2 |
2019-04-04 |
| snort |
ET POLICY Possible Successful Phish - Password Submitted to *.000webhostapp.com |
rev 2 |
2019-04-03 |
| snort |
ET TROJAN Xwo CnC Activity |
rev 2 |
2019-04-02 |
| snort |
ET TROJAN ServHelper CnC Inital Checkin |
rev 3 |
2019-04-01 |
| snort |
ET TROJAN Evil PDF Retrieving Emotet Payload |
rev 2 |
2019-03-28 |
| snort |
ET TROJAN Suspicious POST with Common Windows Process Names - Possible Process List Exfiltration |
rev 3 |
2019-03-28 |
| snort |
ET TROJAN JasperLoader CnC Checkin |
rev 3 |
2019-03-27 |
| snort |
ET TROJAN W32/VBS.SLoad.Backdoor Initial Base64 Encoded OK Server Response |
rev 1 |
2019-03-27 |
| snort |
ET INFO SUSPICIOUS SMTP EXE - EXE SMTP Attachment |
rev 2 |
2019-03-27 |
| snort |
ET TROJAN Possible ShadowHammer DNS Lookup |
rev 2 |
2019-03-25 |
| snort |
ET EXPLOIT Linksys E-Series Device RCE Attempt |
rev 3 |
2019-03-25 |
| snort |
ET TROJAN MSIL/DataMilk Stealer Communicating with CnC |
rev 1 |
2019-03-25 |
| snort |
ET TROJAN ShadowHammer DNS Lookup |
rev 2 |
2019-03-25 |
| snort |
ET TROJAN Possible ShadowHammer DNS Lookup |
rev 2 |
2019-03-25 |
| snort |
ET TROJAN Win32/Dorv Stealer Exfiltrating Data to CnC |
rev 4 |
2019-03-25 |
| snort |
ET TROJAN ChaseBot CnC Checkin |
rev 2 |
2019-03-25 |
| snort |
ET TROJAN RocketMan Win32/Drun |
rev 2 |
2019-03-24 |