| snort |
ET CURRENT_EVENTS Successful Docusign/Outlook Phish 2016-08-17 |
rev 1 |
2016-08-17 |
| snort |
ET EXPLOIT Equation Group ExtraBacon Cisco ASA AAAADMINAUTH Disable |
rev 1 |
2016-08-17 |
| snort |
ET CURRENT_EVENTS Successful Google Drive Phish 2015-09-04 |
rev 2 |
2016-08-17 |
| snort |
ET CURRENT_EVENTS SUSPICIOUS Grey Advertising Often Leading to EK |
rev 2 |
2016-08-17 |
| snort |
ET CURRENT_EVENTS Netflix Phishing Landing 2016-08-17 |
rev 1 |
2016-08-17 |
| snort |
ET EXPLOIT Equation Group ExtraBacon Cisco ASA PMCHECK Disable |
rev 1 |
2016-08-17 |
| snort |
ET CURRENT_EVENTS Successful Gmail Phish 2015-11-05 |
rev 2 |
2016-08-17 |
| snort |
ET CURRENT_EVENTS Successful Docusign Phish M1 2016-08-17 |
rev 1 |
2016-08-17 |
| snort |
ET CURRENT_EVENTS Possible Bank of America Phishing Domain Aug 15 2016 |
rev 2 |
2016-08-17 |
| snort |
ET CURRENT_EVENTS RIG EK Payload Jun 26 2016 |
rev 2 |
2016-08-16 |
| snort |
ET CURRENT_EVENTS Suspicious HTTP Refresh to SMS Aug 16 2016 |
rev 1 |
2016-08-16 |
| snort |
ET CURRENT_EVENTS Adobe Phishing Landing M1 2016-08-16 |
rev 1 |
2016-08-16 |
| snort |
ET CURRENT_EVENTS Email Storage Upgrade Phishing Landing 2016-08-15 |
rev 1 |
2016-08-15 |
| snort |
ET TROJAN Executable Download Purporting to be JavaScript likely 2nd stage Infection |
rev 2 |
2016-08-12 |
| snort |
ET CURRENT_EVENTS Successful Gmail Phish M1 2016-08-12 |
rev 1 |
2016-08-12 |
| snort |
ET DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port |
rev 2 |
2016-08-12 |
| snort |
ET DOS DNS Amplification Attack Possible Inbound Windows Non-Recursive Root Hint Reserved Port |
rev 2 |
2016-08-12 |
| snort |
ET WEB_CLIENT Tech Support Phone Scam Landing M1 2016-08-12 |
rev 1 |
2016-08-12 |
| snort |
ET WEB_CLIENT Tech Support Phone Scam Landing M2 2016-08-12 |
rev 1 |
2016-08-12 |
| snort |
ET TROJAN Monsoon Tinytyphon CnC Beacon GET |
rev 1 |
2016-08-11 |
| snort |
ET CURRENT_EVENTS Successful DHL Phish 2016-08-11 |
rev 1 |
2016-08-11 |
| snort |
ET CURRENT_EVENTS Successful Adobe Shared Document Phish 2016-08-11 |
rev 1 |
2016-08-11 |
| snort |
ET TROJAN Monsoon Tinytyphon CnC Beacon Exfiltrating Docs |
rev 1 |
2016-08-11 |
| snort |
ET CURRENT_EVENTS DHL/EMS Documents Phishing Landing 2016-08-10 |
rev 1 |
2016-08-10 |
| snort |
ET TROJAN Linux/Lady CnC Beacon 2 |
rev 1 |
2016-08-10 |
| snort |
ET INFO Successful Tectite Web Form Submission - Possible Phishing |
rev 1 |
2016-08-10 |
| snort |
ET TROJAN Linux/Lady CnC Beacon 1 |
rev 1 |
2016-08-10 |
| snort |
ET WEB_CLIENT Suspicious Credential POST to FormBuddy.com - Possible Phishing Aug 10 2016 |
rev 1 |
2016-08-10 |
| snort |
ET CURRENT_EVENTS Possible Phishing Landing - Tectite Web Form Abuse |
rev 2 |
2016-08-10 |
| snort |
ET CURRENT_EVENTS Tectite Web Form Submission - Possible Successful Phish |
rev 1 |
2016-08-10 |
| snort |
ET CURRENT_EVENTS Adobe Shared Document Phishing Landing Common CSS 2016-08-10 |
rev 1 |
2016-08-10 |
| snort |
ET POLICY Outgoing Chromoting Session Response |
rev 3 |
2016-08-09 |
| snort |
ET POLICY Incoming Chromoting Session Response |
rev 4 |
2016-08-09 |
| snort |
ET TROJAN RAMNIT.A M1 |
rev 1 |
2016-08-09 |
| snort |
ET TROJAN Win32/Radonskra.B C2 Check-in |
rev 1 |
2016-08-09 |
| snort |
GPL EXPLOIT WEB-MISC JBoss RMI class download service directory listing attempt |
rev 1 |
2016-08-04 |
| snort |
ET WEB_CLIENT Metasploit Browser Autopwn Aug1 2016 |
rev 1 |
2016-08-02 |
| snort |
ET CURRENT_EVENTS Successful Wells Fargo Mobile Phish 2016-08-01 M3 |
rev 1 |
2016-08-01 |
| snort |
ET CURRENT_EVENTS Successful Intuit Phish 2016-08-01 |
rev 1 |
2016-08-01 |
| snort |
ET CURRENT_EVENTS Wells Fargo Mobile Phishing Landing 2016-08-01 |
rev 1 |
2016-08-01 |