| suricata |
ET MALWARE DonotGroup Staging Domain in DNS Query |
rev 3 |
2020-11-17 |
| suricata |
ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M4 |
rev 3 |
2020-11-17 |
| suricata |
ET PHISHING Possible Facebook Phishing Landing - Title over non SSL |
rev 4 |
2020-11-17 |
| suricata |
ET PHISHING Possible Successful Generic Phish to .ml Domain 2018-10-23 |
rev 4 |
2020-11-17 |
| snort |
ET TROJAN Win32/TrickBot Anchor Variant Style External IP Check |
rev 2 |
2020-11-16 |
| snort |
ET TROJAN APT Lazarus Nukesped Downloader |
rev 2 |
2020-11-16 |
| suricata |
ET INFO Java .jar request to dotted-quad domain |
rev 6 |
2020-11-16 |
| suricata |
ET MALWARE Observed DNS Query to Redkeeper Ransomware Domain |
rev 2 |
2020-11-16 |
| suricata |
ET INFO Observed DNS Query to .burpcollector .net Domain |
rev 2 |
2020-11-16 |
| snort |
ET POLICY HTTP POST to MEGA Userstorage |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN FinSpy Related WinRAR Activity |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN nspps Backdoor - Task Response |
rev 3 |
2020-11-12 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-11-12 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-11-12 |
| snort |
ET WEB_SERVER Generic Webshell Activity |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN MSIL/Modi RAT CnC Screenshot Outbound |
rev 3 |
2020-11-12 |
| snort |
ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server |
rev 2 |
2020-11-12 |
| snort |
ET WEB_SPECIFIC_APPS Attempted Symantec Secure Web Gateway RCE |
rev 3 |
2020-11-12 |
| snort |
GPL EXPLOIT .cnf access |
rev 15 |
2020-11-12 |
| snort |
ET TROJAN M3RAT CnC Checkin Outbound |
rev 2 |
2020-11-12 |
| snort |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-11-12 |
| snort |
ET WEB_SERVER Generic Webshell Accessed |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN MageCart Exfil URI |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN EvilNum CnC Client Data Exfil |
rev 3 |
2020-11-12 |
| snort |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-11-12 |
| snort |
ET TROJAN Possible Satan Cryptor GeoIP Lookup |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN ELF Linux/Dnsamp.AB Variant CnC |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN [PTsecurity] MZRevenge Ransomware Server Response |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN FinSpy Related Flash Installer Activity |
rev 3 |
2020-11-12 |
| snort |
ET INFO Suspicious HTTP POST to 404.php |
rev 3 |
2020-11-12 |
| snort |
ET TROJAN Amarula IRC Botnet Connection Request |
rev 3 |
2020-11-12 |
| snort |
ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server |
rev 2 |
2020-11-12 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-11-12 |
| suricata |
ET WEB_CLIENT Generic Mailer Accessed on External Compromised Server |
rev 2 |
2020-11-12 |
| suricata |
ET WEB_CLIENT Generic Webshell Accessed on External Compromised Server |
rev 2 |
2020-11-12 |
| suricata |
ET MALWARE MSIL/Modi RAT CnC Screenshot Outbound |
rev 3 |
2020-11-12 |
| suricata |
ET MALWARE M3RAT CnC Checkin Outbound |
rev 2 |
2020-11-12 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-11-12 |
| suricata |
ET WEB_SERVER Generic Webshell Accessed on Internal Compromised Server |
rev 2 |
2020-11-12 |
| suricata |
ET WEB_SERVER Generic Mailer Accessed on Internal Compromised Server |
rev 2 |
2020-11-12 |