| snort |
ET USER_AGENTS FOCA User-Agent |
rev 3 |
2014-01-10 |
| snort |
ET SCAN FOCA uri |
rev 2 |
2014-01-10 |
| snort |
ET TROJAN LDPinch Checkin Post |
rev 1 |
2014-01-10 |
| snort |
ET TROJAN Fake/Short Google Search Appliance UA Win32/Ranbyus and Others |
rev 1 |
2014-01-08 |
| snort |
ET TROJAN Trojan Generic - POST To gate.php with no referer |
rev 8 |
2014-01-04 |
| snort |
ET POLICY check.torproject.org IP lookup/Tor Usage check over TLS with SNI |
rev 2 |
2014-01-04 |
| snort |
ET POLICY bridges.torproject.org over TLS with SNI |
rev 2 |
2014-01-04 |
| snort |
ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x02 |
rev 2 |
2014-01-03 |
| snort |
ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x03 |
rev 2 |
2014-01-03 |
| snort |
ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x02 |
rev 2 |
2014-01-03 |
| snort |
ET INFO suspicious - gzipped file via JAVA - could be pack200-ed JAR |
rev 2 |
2013-12-31 |
| snort |
ET INFO suspicious - uncompressed pack200-ed JAR |
rev 2 |
2013-12-31 |
| snort |
ET EXPLOIT Metasploit Plugin-Detect Posting Data 1 |
rev 3 |
2013-12-24 |
| snort |
ET EXPLOIT Metasploit Plugin-Detect Posting Data 2 |
rev 3 |
2013-12-24 |
| snort |
ET EXPLOIT Metasploit Plugin-Detect Posting Data 3 |
rev 3 |
2013-12-24 |
| snort |
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
rev 6 |
2013-12-24 |
| snort |
ET TROJAN W32/GMUnpacker.Downloader Download Instructions Response From CnC |
rev 1 |
2013-12-20 |
| snort |
ET CURRENT_EVENTS CritXPack Jar Request |
rev 10 |
2013-12-19 |
| snort |
ET TROJAN W32/Liftoh.Downloader Get Final Payload Request |
rev 2 |
2013-12-17 |
| snort |
ET TROJAN W32/Liftoh.Downloader Feed404 CnC Beacon |
rev 1 |
2013-12-17 |
| snort |
ET TROJAN W32/Liftoh.Downloader Images CnC Beacon |
rev 1 |
2013-12-17 |
| snort |
ET TROJAN W32/Ke3chang.MovieStar.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.Snake.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.MyWeb.APT Eourdegh Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.Dream.APT Campaign CnC Beacon 2 |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.MyWeb.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN WEBC2-QBP Checkin Response 1 - Embedded CnC APT1 Related |
rev 2 |
2013-12-13 |
| snort |
ET TROJAN Vawtrak/NeverQuest Checkin |
rev 1 |
2013-12-12 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attack Done Message |
rev 1 |
2013-12-10 |
| snort |
ET WEB_SERVER IIS ISN BackDoor Command GetLog |
rev 4 |
2013-12-10 |
| snort |
ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC No Open Ports Message |
rev 1 |
2013-12-10 |
| snort |
ET WEB_SERVER Perl/Mambo.WebShell Spreader IRC Scanning Message |
rev 2 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS PerlBot Version Message |
rev 2 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Exploited Message |
rev 3 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Mambo Scanning Message |
rev 2 |
2013-12-10 |
| snort |
ET TROJAN Common Zbot EXE filename Dec 09 2013 |
rev 1 |
2013-12-10 |
| snort |
ET WEB_SERVER Mambo.PerlBot Spreader IRC DDOS Attacking Message |
rev 2 |
2013-12-10 |
| snort |
ET CURRENT_EVENTS Probable Sakura exploit kit landing page obfuscated applet tag Mar 1 2013 |
rev 4 |
2013-12-09 |
| snort |
ET WEB_SERVER Possible WebLogic Admin Login With Default Creds |
rev 3 |
2013-12-06 |
| snort |
ET WEB_SERVER Possible MySQL SQLi Attempt Information Schema Access |
rev 1 |
2013-12-06 |