| snort |
ET EXPLOIT VisualDoor Sonicwall SSL VPN Exploit Attempt |
rev 2 |
2021-01-25 |
| snort |
ET TROJAN [401TRG] SUNBURST Related DNS Lookup to bigtopweb .com |
rev 2 |
2021-01-25 |
| snort |
ET TROJAN [401TRG] SUNBURST Related DNS Lookup to infinitysoftwares .com |
rev 2 |
2021-01-25 |
| suricata |
ET INFO File Downloaded from Discord |
rev 4 |
2021-01-25 |
| suricata |
ET MALWARE [401TRG] SUNBURST Related DNS Lookup to bigtopweb .com |
rev 1 |
2021-01-25 |
| suricata |
ET MALWARE [401TRG] SUNBURST Related DNS Lookup to infinitysoftwares .com |
rev 1 |
2021-01-25 |
| suricata |
ET EXPLOIT VisualDoor Sonicwall SSL VPN Exploit Attempt |
rev 2 |
2021-01-25 |
| snort |
ET TROJAN ELF/Freakout IRC Checkin |
rev 2 |
2021-01-20 |
| snort |
ET TROJAN OSX/WizardUpdate CnC Activity |
rev 2 |
2021-01-20 |
| suricata |
ET MALWARE ELF/Freakout IRC Checkin |
rev 1 |
2021-01-20 |
| snort |
ET EXPLOIT [401TRG] DeDeCMS RFI Attempt |
rev 2 |
2021-01-19 |
| snort |
ET TROJAN Arbitrium-RAT CnC Activity |
rev 2 |
2021-01-19 |
| snort |
ET TROJAN Win32/FFDroider CnC Activity |
rev 2 |
2021-01-19 |
| suricata |
ET MALWARE Arbitrium-RAT CnC Activity |
rev 1 |
2021-01-19 |
| suricata |
ET EXPLOIT [401TRG] DeDeCMS RFI Attempt |
rev 2 |
2021-01-19 |
| sigma |
Local User Creation |
test |
2021-01-17 |
| sigma |
User Added to Local Administrator Group |
stable |
2021-01-17 |
| snort |
ET MOBILE_MALWARE ITW Android Post-Exploit Downloader CnC Activity |
rev 3 |
2021-01-15 |
| snort |
ET TROJAN Danabot Key Exchange Request |
rev 2 |
2021-01-14 |
| snort |
ET INFO Suspicious HTTP POST Only Containing Pass - Possible Phishing |
rev 2 |
2021-01-14 |
| snort |
ET INFO Suspicious HTTP POST Only Containing Password - Possible Phishing |
rev 2 |
2021-01-14 |
| suricata |
ET MALWARE Danabot Key Exchange Request |
rev 2 |
2021-01-14 |
| snort |
ET TROJAN Win32/Qihoo360.J Variant Install Report |
rev 2 |
2021-01-13 |
| suricata |
ET ADWARE_PUP Win32/Qihoo360.J Variant Install Report |
rev 1 |
2021-01-13 |
| snort |
ET TROJAN PlugX DNS Lookup |
rev 2 |
2021-01-12 |
| snort |
ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server |
rev 2 |
2021-01-12 |
| snort |
ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server |
rev 2 |
2021-01-12 |
| snort |
ET TROJAN Known Sinkhole Response Kryptos Logic |
rev 2 |
2021-01-12 |
| suricata |
ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server |
rev 2 |
2021-01-12 |
| suricata |
ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server |
rev 2 |
2021-01-12 |
| snort |
ET WEB_CLIENT Generic Attempted Executable Drop via VBScript |
rev 2 |
2021-01-11 |
| suricata |
ET WEB_CLIENT Generic Attempted Executable Drop via VBScript |
rev 2 |
2021-01-11 |
| snort |
ET TROJAN Amadey Stealer CnC |
rev 2 |
2021-01-08 |
| snort |
ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML |
rev 2 |
2021-01-08 |
| suricata |
ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML |
rev 1 |
2021-01-08 |
| snort |
ET TROJAN Win32/Injector.ULH CnC Activity |
rev 2 |
2021-01-07 |
| snort |
ET CURRENT_EVENTS Possible Instagram Phishing or Scam Landing Page |
rev 2 |
2021-01-07 |
| suricata |
ET PHISHING Possible Instagram Phishing or Scam Landing Page |
rev 2 |
2021-01-07 |
| snort |
ET CURRENT_EVENTS Apple Phishing Panel Accessed on External Compromised Server |
rev 2 |
2021-01-06 |
| snort |
ET TROJAN IceRat CnC Acitivty M2 |
rev 2 |
2021-01-06 |