| suricata |
ET MALWARE Suspicious Long NULL DNS Request - Possible DNS Tunneling |
rev 2 |
2022-03-31 |
| snort |
ET TROJAN Trojan.Verblecon User Agent Observed |
rev 2 |
2022-03-30 |
| suricata |
ET MALWARE Trojan.Verblecon User Agent Observed |
rev 2 |
2022-03-30 |
| snort |
ET TROJAN APT CozyCar SSL Cert 2 |
rev 2 |
2022-03-29 |
| snort |
ET EXPLOIT WatchGuard CVE-2022-26318 RCE Attempt M1 |
rev 2 |
2022-03-29 |
| suricata |
ET EXPLOIT WatchGuard CVE-2022-26318 RCE Attempt M2 |
rev 2 |
2022-03-29 |
| suricata |
ET EXPLOIT WatchGuard CVE-2022-26318 RCE Attempt M1 |
rev 2 |
2022-03-29 |
| snort |
ET TROJAN APT CozyCar SSL Cert 5 |
rev 2 |
2022-03-28 |
| snort |
ET TROJAN APT CozyCar SSL Cert 6 |
rev 2 |
2022-03-28 |
| snort |
ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M4 |
rev 2 |
2022-03-28 |
| snort |
ET TROJAN PurpleFox Backdoor/Rootkit Download Server Response M3 |
rev 2 |
2022-03-28 |
| sigma |
Narrator's Feedback-Hub Persistence |
test |
2022-03-26 |
| snort |
ET POLICY DivX Client SSL Connection via Self-Signed SSL Cert |
rev 3 |
2022-03-25 |
| snort |
ET TROJAN FIN7 JSSLoader Related Domain in DNS Lookup |
rev 2 |
2022-03-25 |
| snort |
ET POLICY Dropbox.com Offsite File Backup in Use |
rev 6 |
2022-03-25 |
| snort |
ET TROJAN Win32/SodaMaster CnC HTTPS Checkin M1 |
rev 1 |
2022-03-25 |
| suricata |
ET INFO Cisco IOS Self Signed Certificate Served to External Host |
rev 4 |
2022-03-25 |
| suricata |
ET MALWARE Win32/SodaMaster CnC HTTPS Checkin M1 |
rev 1 |
2022-03-25 |
| suricata |
ET INFO Dropbox.com Offsite File Backup in Use |
rev 7 |
2022-03-25 |
| suricata |
ET INFO DivX Client SSL Connection via Self-Signed SSL Cert |
rev 3 |
2022-03-25 |
| snort |
ET TROJAN Win32/TrojanDownloader.Agent.GEM CnC Checkin |
rev 1 |
2022-03-24 |
| snort |
ET INFO Suspicious Empty SSL Certificate - Observed in Cobalt Strike |
rev 3 |
2022-03-24 |
| snort |
ET INFO DropBox User Content Download Access over SSL M2 |
rev 2 |
2022-03-24 |
| snort |
ET TROJAN SERVER SSL Cert APT1 |
rev 4 |
2022-03-24 |
| suricata |
ET PHISHING Request for Possible Binance Phishing Hosted on Github.io |
rev 4 |
2022-03-24 |
| suricata |
ET MALWARE HVNC USR Init Detected |
rev 3 |
2022-03-24 |
| suricata |
ET EXPLOIT TOTOLINK Router DNS Changer Exploit Attempt |
rev 4 |
2022-03-24 |
| suricata |
ET MALWARE MuddyWater Payload Sending Screenshot to CnC |
rev 4 |
2022-03-24 |
| suricata |
ET MALWARE RedControle Communicating with CnC |
rev 4 |
2022-03-24 |
| suricata |
ET PHISHING Request for Possible Docusign Phishing Hosted on Github.io |
rev 4 |
2022-03-24 |
| suricata |
ET PHISHING Request for Possible Ebay Phishing Hosted on Github.io |
rev 4 |
2022-03-24 |
| suricata |
ET INFO DropBox User Content Download Access over SSL M2 |
rev 2 |
2022-03-24 |
| suricata |
ET PHISHING Request for Possible DHL Phishing Hosted on Github.io |
rev 4 |
2022-03-24 |
| suricata |
ET MALWARE Tick Group Payload - Reporting Error to CnC |
rev 2 |
2022-03-24 |
| suricata |
ET MALWARE Win32/Retadup CnC Checkin M2 |
rev 4 |
2022-03-24 |
| suricata |
ET MALWARE [Fireeye] Backdoor.SUNBURST HTTP Request to avsvmcloud .com |
rev 4 |
2022-03-24 |
| suricata |
ET EXPLOIT FatPipe Unrestricted File Upload |
rev 3 |
2022-03-24 |
| suricata |
ET PHISHING Request for Possible Adobe Phishing Hosted on Github.io |
rev 8 |
2022-03-24 |
| suricata |
ET PHISHING Request for Possible Outlook Phishing Hosted on Github.io |
rev 4 |
2022-03-24 |
| suricata |
ET PHISHING Request for Possible Account Phishing Hosted on Github.io |
rev 4 |
2022-03-24 |