| snort |
ET TROJAN Win32/Enchanim Check-in Response |
rev 1 |
2013-04-19 |
| snort |
ET TROJAN Win32/Enchanim Process List Dump |
rev 1 |
2013-04-19 |
| snort |
ET INFO Generic HTTP EXE Upload Outbound |
rev 1 |
2013-04-19 |
| snort |
ET TROJAN Win32/Enchanim C2 Injection Download |
rev 4 |
2013-04-19 |
| snort |
ET INFO Generic HTTP EXE Upload Inbound |
rev 1 |
2013-04-19 |
| snort |
ET INFO PDF - Acrobat Enumeration - pdfobject.js |
rev 1 |
2013-04-18 |
| snort |
ET INFO PDF - Acrobat Enumeration - var PDFObject |
rev 1 |
2013-04-18 |
| snort |
ET TROJAN OSX/Flashback.K/I reporting successful infection 2 |
rev 4 |
2013-04-18 |
| snort |
ET CURRENT_EVENTS SofosFO obfuscator string 19 Dec 12 - possible landing |
rev 4 |
2013-04-17 |
| snort |
ET WEB_SERVER WebShell - PHPShell - PHPKonsole URI |
rev 1 |
2013-04-17 |
| snort |
ET WEB_SERVER WebShell - PHPShell - Haxplorer URI |
rev 1 |
2013-04-16 |
| snort |
ET POLICY Bitcoin Mining Extensions Header |
rev 3 |
2013-04-16 |
| snort |
ET WEB_SERVER WebShell - PHPShell - Comment |
rev 1 |
2013-04-16 |
| snort |
ET INFO Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download |
rev 12 |
2013-04-13 |
| snort |
ET CURRENT_EVENTS Unknown_gmf EK - pdfx.html |
rev 2 |
2013-04-12 |
| snort |
ET INFO Suspicious explorer.exe in URI |
rev 12 |
2013-04-10 |
| snort |
ET TROJAN Haxdoor Reporting User Activity 2 |
rev 7 |
2013-04-10 |
| snort |
ET INFO Suspicious smss.exe in URI |
rev 12 |
2013-04-10 |
| snort |
ET TROJAN RansomCrypt Getting Template |
rev 1 |
2013-04-10 |
| snort |
ET TROJAN W32/Citadel Conf.bin Download From CnC Server |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel File.php CnC POST |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel Content.php CnC POST |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel Infection or Config URL Request |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN W32/NSISDL.Downloader CnC Server Response |
rev 1 |
2013-04-09 |
| snort |
ET INFO Suspicious lsass.exe in URI |
rev 11 |
2013-04-09 |
| snort |
ET INFO Suspicious winlogin.exe in URI |
rev 12 |
2013-04-09 |
| snort |
ET INFO Suspicious services.exe in URI |
rev 12 |
2013-04-09 |
| snort |
ET INFO Suspicious csrss.exe in URI |
rev 11 |
2013-04-09 |
| snort |
ET TROJAN W32/Citadel Pro File.php CnC POST |
rev 1 |
2013-04-09 |
| snort |
ET CURRENT_EVENTS RedKit applet + obfuscated URL Apr 7 2013 |
rev 1 |
2013-04-09 |
| snort |
ET TROJAN Revoyem Ransomware Check-in |
rev 3 |
2013-04-06 |
| snort |
ET TROJAN W32/BaneChant.APT Winword.pkg Redirect |
rev 1 |
2013-04-04 |
| snort |
ET SHELLCODE Possible Backslash Escaped UTF-8 0c0c Heap Spray |
rev 1 |
2013-04-04 |
| snort |
ET WEB_SERVER WebShell - MySQL Interface - Auth Prompt |
rev 1 |
2013-04-02 |
| snort |
ET CURRENT_EVENTS DRIVEBY EgyPack Exploit Kit Cookie Set |
rev 3 |
2013-04-02 |
| snort |
ET CURRENT_EVENTS DRIVEBY EgyPack Exploit Kit Cookie Present |
rev 3 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/8 |
rev 1 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/9 |
rev 1 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/0 |
rev 1 |
2013-04-02 |
| snort |
ET INFO SUSPICIOUS UA starting with Mozilla/7 |
rev 1 |
2013-04-02 |