| snort |
ET TROJAN NCSC XAgent itwm beacon v2 |
rev 1 |
2018-10-04 |
| snort |
ET TROJAN NCSC APT28 - Web/request -FILE- contenttype |
rev 2 |
2018-10-04 |
| snort |
ET TROJAN NCSC XAgent itwm beacon v1 |
rev 1 |
2018-10-04 |
| snort |
ET TROJAN Win32.YordanyanActiveAgent Generic CnC Pattern |
rev 2 |
2018-10-04 |
| snort |
ET POLICY Suspicious Malformed Double Accept Header |
rev 14 |
2018-10-03 |
| snort |
ET TROJAN VPNFilter htpx Module C2 Request |
rev 1 |
2018-10-01 |
| snort |
ET CURRENT_EVENTS Generic MRxJoker Phishing Landing 2018-09-27 |
rev 2 |
2018-09-27 |
| snort |
ET CURRENT_EVENTS Successful Generic Personalized Phish 2018-09-27 M2 |
rev 2 |
2018-09-27 |
| snort |
ET TROJAN Suspected fraud-bridge DNS Tunnel |
rev 2 |
2018-09-26 |
| snort |
ET TROJAN Suspected DNS2TCP Auth |
rev 2 |
2018-09-26 |
| snort |
ET TROJAN Suspected DNS2TCP Connect |
rev 2 |
2018-09-26 |
| snort |
ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 1 |
rev 3 |
2018-09-25 |
| snort |
ET WEB_SERVER JSP.SJavaWebManage WebShell Access |
rev 3 |
2018-09-25 |
| snort |
ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 2 |
rev 3 |
2018-09-25 |
| snort |
ET TROJAN Observed UltraVNC CnC Activity |
rev 2 |
2018-09-21 |
| snort |
ET TROJAN HTML/Xbash Hex Encoded PowerShell Args Inbound - Stage 1 |
rev 2 |
2018-09-20 |
| snort |
ET TROJAN HTML/Xbash Hex Encoded WScript.Shell Inbound - Stage 1 |
rev 2 |
2018-09-20 |
| snort |
ET TROJAN HTML/Xbash Hex Encoded PS WebClient Object Inbound - Stage 1 |
rev 2 |
2018-09-20 |
| snort |
ET CURRENT_EVENTS Possible Tor/Noscript JS Bypass |
rev 2 |
2018-09-11 |
| snort |
ET EXPLOIT NetGain Enterprise Manager 7.2.562 Ping Command Injection |
rev 2 |
2018-09-10 |
| snort |
ET USER_AGENTS MSIL/Peppy User-Agent |
rev 2 |
2018-09-07 |
| snort |
ET TROJAN Win32/Aura Ransomware CnC Activity |
rev 2 |
2018-09-06 |
| snort |
ET TROJAN MSIL/Eredel Stealer CnC Checkin |
rev 4 |
2018-09-06 |
| snort |
ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt |
rev 2 |
2018-09-05 |
| snort |
ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt |
rev 1 |
2018-09-05 |
| snort |
ET EXPLOIT Ghostscript illegal read undefinedfilename attempt |
rev 1 |
2018-09-05 |
| snort |
ET EXPLOIT Ghostscript setpattern type confusion attempt |
rev 1 |
2018-09-05 |
| snort |
ET TROJAN OilRig OopsIE CnC Checkin M3 |
rev 2 |
2018-09-05 |
| snort |
ET EXPLOIT Ghostscript invalidcheck escape attempt |
rev 1 |
2018-09-05 |
| snort |
ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt |
rev 1 |
2018-09-05 |
| snort |
ET TROJAN Suspected Monero Miner CnC Channel Secondary Domain Lookup |
rev 1 |
2018-09-05 |
| snort |
ET TROJAN OilRig OopsIE CnC Checkin M4 |
rev 2 |
2018-09-05 |
| snort |
ET TROJAN Win32/BanloadDownloader.XZY Retrieving Payload |
rev 3 |
2018-09-05 |
| snort |
ET EXPLOIT Ghostscript LockDistillerParams type confusion attempt |
rev 1 |
2018-09-05 |
| snort |
ET TROJAN W32.FakeEzQ.kr Checkin |
rev 1 |
2018-08-31 |
| snort |
ET WEB_CLIENT Generic PhishKit Author Comment M7 2018-08-30 |
rev 2 |
2018-08-30 |
| snort |
ET WEB_CLIENT Generic PhishKit Author Comment M3 2018-08-30 |
rev 2 |
2018-08-30 |
| snort |
ET WEB_CLIENT Generic PhishKit Author Comment M10 2018-08-30 |
rev 2 |
2018-08-30 |
| snort |
ET CURRENT_EVENTS AT&T Phishing Landing 2018-08-30 |
rev 2 |
2018-08-30 |
| snort |
ET WEB_CLIENT Generic PhishKit Author Comment M8 2018-08-30 |
rev 2 |
2018-08-30 |