| suricata |
ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce] |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M4 |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M7 |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M6 |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce] |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce 2] |
rev 1 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M3 |
rev 2 |
2020-12-08 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] POSSIBLE HackTool.TCP.Rubeus.[User32LogonProcesss] |
rev 1 |
2020-12-08 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M1 |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce 2] |
rev 1 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M9 |
rev 2 |
2020-12-08 |
| suricata |
ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M8 |
rev 2 |
2020-12-08 |
| snort |
ET TROJAN Jupyter Stealer Reporting System Information |
rev 3 |
2020-12-07 |
| snort |
ET POLICY Outdated Flash Version M2 |
rev 35 |
2020-12-07 |
| snort |
ET TROJAN DarkIRC Bot CnC Domain Lookup |
rev 2 |
2020-12-04 |
| suricata |
ET EXPLOIT D-Link DSL-2740R Remote DNS Change Attempt |
rev 8 |
2020-12-03 |
| snort |
ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain |
rev 2 |
2020-12-02 |
| snort |
ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain |
rev 2 |
2020-12-02 |
| snort |
ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain |
rev 2 |
2020-12-02 |
| snort |
ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain |
rev 2 |
2020-12-02 |
| snort |
ET TROJAN Observed DNS Query to WHO Themed Malware Delivery Domain |
rev 2 |
2020-12-02 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-12-01 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-12-01 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-12-01 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-12-01 |
| snort |
ET CURRENT_EVENTS Successful Generic Credit Card Information Phish 2019-11-04 |
rev 3 |
2020-11-30 |
| snort |
ET CURRENT_EVENTS Possible Successful Generic Windows.net Hosted Phish 2020-10-14 |
rev 3 |
2020-11-30 |
| snort |
ET POLICY ToDesk Remote Access Control Tool |
rev 2 |
2020-11-30 |
| suricata |
ET PHISHING Successful Generic Credit Card Information Phish 2019-11-04 |
rev 3 |
2020-11-30 |
| suricata |
ET PHISHING Possible Successful Generic Windows.net Hosted Phish 2020-10-14 |
rev 3 |
2020-11-30 |
| suricata |
ET INFO ToDesk Remote Access Control Tool |
rev 2 |
2020-11-30 |
| snort |
ET TROJAN Win32/Trickbot Data Exfiltration |
rev 2 |
2020-11-27 |
| suricata |
ET MALWARE Win32/Trickbot Data Exfiltration |
rev 2 |
2020-11-27 |
| snort |
ET CURRENT_EVENTS Chase Phish Landing 2020-11-26 |
rev 2 |
2020-11-26 |
| suricata |
ET PHISHING Chase Phish Landing 2020-11-26 |
rev 2 |
2020-11-26 |
| snort |
ET TROJAN Observed DNS Query to Blackrota Domain |
rev 2 |
2020-11-25 |
| snort |
ET TROJAN Win32/Spy.Agent.QAQ Variant CnC Activity |
rev 2 |
2020-11-24 |
| suricata |
ET EXPLOIT Zollard PHP Exploit UA Outbound |
rev 6 |
2020-11-19 |