| snort |
ET TROJAN PackClient Core startup response state |
rev 1 |
2026-10-01 |
| suricata |
ET MALWARE PackClient Core startup probe state |
rev 1 |
2026-10-01 |
| suricata |
ET MALWARE PackClient Core startup response state |
rev 1 |
2026-10-01 |
| snort |
ET TROJAN PackClient Core startup probe state |
rev 1 |
2026-10-01 |
| splunk |
Cisco Secure Firewall - Intrusion Events by Threat Activity |
production |
2026-09-22 |
| elastic |
Potential Data Exfiltration Activity to an Unusual IP Address |
production |
2026-09-18 |
| elastic |
Unusual Network Destination Domain Name |
production |
2026-09-18 |
| elastic |
Unusual Azure Activity Logs Event for a User |
production |
2026-09-18 |
| elastic |
Network Traffic to Rare Destination Country |
production |
2026-09-18 |
| elastic |
Spike in Firewall Denies |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Port Activity |
production |
2026-09-18 |
| elastic |
Spike in host-based traffic |
production |
2026-09-18 |
| elastic |
Unusual GCP Event for a User |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual Destination Port |
production |
2026-09-18 |
| elastic |
Network Activity Detected via Kworker |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic |
production |
2026-09-18 |
| elastic |
DNS Tunneling |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual ISO Code |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual Region |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Activity |
production |
2026-09-18 |
| elastic |
Unusual Windows Network Activity |
production |
2026-09-18 |
| elastic |
Unusual AWS Command for a User |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic To a Country |
production |
2026-09-18 |
| snort |
ET TROJAN go-titan Registration Attempt |
rev 1 |
2026-08-21 |
| suricata |
ET MALWARE go-titan Registration Attempt |
rev 1 |
2026-08-21 |
| snort |
ET TROJAN JS SpyPress C2 Beacon |
rev 1 |
2026-07-21 |
| suricata |
ET MALWARE JS SpyPress C2 Beacon |
rev 1 |
2026-07-21 |
| suricata |
ET MALWARE MarkiRAT CnC Checkin Attempt |
rev 1 |
2026-07-02 |
| suricata |
ET MALWARE MarkiRAT Data Exfiltration Attempt |
rev 1 |
2026-07-02 |
| snort |
ET TROJAN MarkiRAT Data Exfiltration Attempt |
rev 1 |
2026-07-02 |
| snort |
ET TROJAN MarkiRAT CnC Checkin Attempt |
rev 1 |
2026-07-02 |
| snort |
ET TROJAN implant.js Linux Beacon Check-in |
rev 3 |
2026-05-21 |
| snort |
ET TROJAN implant.js Windows Beacon Check-in |
rev 3 |
2026-05-21 |
| suricata |
ET MALWARE implant.js Linux Beacon Check-in |
rev 3 |
2026-05-21 |
| suricata |
ET MALWARE implant.js Windows Beacon Check-in |
rev 3 |
2026-05-21 |
| suricata |
ET MALWARE SainboxRAT CnC Checkin |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN SainboxRAT CnC Checkin |
rev 1 |
2026-05-14 |
| splunk |
Windows Exfiltration Over C2 Via Powershell UploadString |
production |
2026-05-13 |
| splunk |
Windows Exfiltration Over C2 Via Invoke RestMethod |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt |
production |
2026-05-13 |
| splunk |
Potential Telegram API Request Via CommandLine |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Download Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Potential Data Exfiltration |
production |
2026-05-13 |
| splunk |
Detect SNICat SNI Exfiltration |
experimental |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High EVE Threat Confidence |
production |
2026-05-13 |
| splunk |
Cisco ASA - Device File Copy to Remote Location |
production |
2026-05-13 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| snort |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Observed Transportation Cargo Theft Domain in TLS SNI |
rev 1 |
2026-05-04 |
| snort |
ET TROJAN XorBee RAT CNC Checkin M1 |
rev 1 |
2026-04-13 |
| suricata |
ET MALWARE XorBee RAT CNC Checkin M1 |
rev 1 |
2026-04-13 |
| snort |
ET TROJAN UNK_MonkeyWrench Exfil via SMTP |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE UNK_MonkeyWrench Exfil via SMTP |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN DarkSword C2 Landing Page |
rev 1 |
2026-03-24 |
| suricata |
ET MALWARE DarkSword C2 Landing Page |
rev 1 |
2026-03-24 |
| suricata |
ET MALWARE AstarionRAT CnC Checkin |
rev 1 |
2026-02-17 |
| snort |
ET TROJAN AstarionRAT CnC Checkin |
rev 1 |
2026-02-17 |
| snort |
ET TROJAN upStage Residential Proxy CnC Response |
rev 1 |
2026-02-11 |
| suricata |
ET MALWARE upStage Residential Proxy CnC Response |
rev 1 |
2026-02-11 |
| suricata |
ET MALWARE DesckVB RAT D ping request/response |
rev 1 |
2026-02-05 |
| suricata |
ET MALWARE DesckVB RAT BlugPass Checkin - Webcam Enumeration |
rev 1 |
2026-02-05 |
| suricata |
ET MALWARE DesckVB RAT BlugPass Checkin |
rev 1 |
2026-02-05 |
| snort |
ET TROJAN DesckVB RAT D ping request/response |
rev 1 |
2026-02-05 |
| snort |
ET TROJAN DesckVB RAT Ping Checkin |
rev 1 |
2026-02-05 |
| snort |
ET TROJAN DesckVB RAT CnC Checkin |
rev 1 |
2026-02-05 |
| snort |
ET TROJAN DesckVB RAT BlugPass Checkin |
rev 1 |
2026-02-05 |
| suricata |
ET MALWARE DesckVB RAT CnC Checkin |
rev 1 |
2026-02-05 |
| suricata |
ET MALWARE DesckVB RAT DetectaAV Checkin |
rev 1 |
2026-02-05 |
| snort |
ET TROJAN DesckVB RAT BlugPass Checkin - Webcam Enumeration |
rev 1 |
2026-02-05 |
| snort |
ET TROJAN DesckVB RAT DetectaAV Checkin |
rev 1 |
2026-02-05 |
| suricata |
ET MALWARE DesckVB RAT Ping Checkin |
rev 1 |
2026-02-05 |
| snort |
ET TROJAN PulsarRAT CnC Traffic Observed |
rev 1 |
2026-02-03 |
| suricata |
ET MALWARE PulsarRAT CnC Traffic Observed |
rev 1 |
2026-02-03 |
| snort |
ET TROJAN GhostPenguin C2 Beacon Observed |
rev 1 |
2026-01-12 |
| suricata |
ET MALWARE GhostPenguin C2 Beacon Observed |
rev 1 |
2026-01-12 |
| suricata |
ET MALWARE DeskRAT CnC HeartBeat Request |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE DeskRAT Victim HeartBeat Response |
rev 1 |
2026-01-09 |
| snort |
ET TROJAN DeskRAT Victim HeartBeat Response |
rev 1 |
2026-01-09 |
| snort |
ET TROJAN DeskRAT CnC HeartBeat Request |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE WeyhroC2 Heartbeat |
rev 1 |
2026-01-08 |
| snort |
ET TROJAN WeyhroC2 Heartbeat |
rev 1 |
2026-01-08 |
| suricata |
ET MALWARE Win.Supper Tunnel C2 Magic Bytes Detected |
rev 1 |
2025-12-22 |
| snort |
ET TROJAN Win.Supper Tunnel C2 Magic Bytes Detected |
rev 1 |
2025-12-22 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M2 |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M2 |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M3 |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT Python Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M3 |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT Python Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M5 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M7 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M2 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M9 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M9 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M7 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M6 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M3 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M8 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M8 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M2 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M4 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M4 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M5 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M3 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M6 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleLoader Malware Inbound Command Retrieval via Finger Service |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleLoader Malware Outbound Payload Request |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleLoader Malware Stager Outbound Payload Request |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN CastleLoader Malware Stager Outbound Payload Request |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN CastleLoader Malware Outbound Payload Request |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN CastleLoader Malware Inbound Command Retrieval via Finger Service |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN TA397/Bitter CnC Domain in DNS Lookup |
rev 1 |
2025-12-15 |
| suricata |
ET MALWARE Observed TA397/Bitter Domain in TLS SNI |
rev 1 |
2025-12-15 |
| suricata |
ET MALWARE TA397/Bitter CnC Domain in DNS Lookup |
rev 1 |
2025-12-15 |
| snort |
ET TROJAN CastleLoader Malware Outbound Checkin |
rev 1 |
2025-12-12 |
| suricata |
ET MALWARE CastleLoader Malware Outbound Checkin |
rev 1 |
2025-12-12 |
| snort |
ET TROJAN TA398 CurlBack_RAT CnC Activity - Fetch Commands M2 |
rev 2 |
2025-11-12 |
| suricata |
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2 |
rev 2 |
2025-11-12 |
| suricata |
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results |
rev 2 |
2025-11-12 |
| snort |
ET TROJAN TA398 CurlBack_RAT CnC Activity - Upload Results |
rev 2 |
2025-11-12 |
| snort |
ET TROJAN FrigidBackdoor Checkin |
rev 2 |
2025-10-08 |
| suricata |
ET MALWARE FrigidBackdoor Checkin |
rev 2 |
2025-10-08 |
| sigma |
Shai-Hulud NPM Package Malicious Exfiltration via Curl |
experimental |
2025-09-24 |
| suricata |
ET MALWARE FrigidBackdoor Poll for Commands |
rev 1 |
2025-09-17 |
| snort |
ET TROJAN FrigidBackdoor Poll for Commands |
rev 1 |
2025-09-17 |
| snort |
ET TROJAN Oyster Backdoor CnC Checkin M2 |
rev 1 |
2025-09-12 |
| snort |
ET TROJAN Oyster Backdoor CnC Checkin M3 |
rev 1 |
2025-09-12 |
| suricata |
ET MALWARE Oyster Backdoor CnC Checkin M2 |
rev 1 |
2025-09-12 |
| suricata |
ET MALWARE Oyster Backdoor CnC Checkin M3 |
rev 1 |
2025-09-12 |
| snort |
ET TROJAN Quad7 Botnet - Outbound alogin Telnet Prompt from Compromised Endpoint |
rev 1 |
2025-09-04 |
| snort |
ET TROJAN Quad7 Botnet UPDTAE Backdoor CnC Checkin |
rev 1 |
2025-09-04 |
| suricata |
ET MALWARE Quad7 Botnet UPDTAE Backdoor CnC Checkin |
rev 1 |
2025-09-04 |
| suricata |
ET MALWARE Quad7 Botnet - Outbound alogin Telnet Prompt from Compromised Endpoint |
rev 1 |
2025-09-04 |
| snort |
ET TROJAN Quad7 Botnet - Outbound rlogin Telnet Prompt from Compromised Endpoint |
rev 1 |
2025-09-04 |
| suricata |
ET MALWARE Quad7 Botnet - Outbound rlogin Telnet Prompt from Compromised Endpoint |
rev 1 |
2025-09-04 |
| suricata |
ET MALWARE Storm-2603 AK47C2 HTTP Backdoor CnC Checkin |
rev 1 |
2025-08-01 |
| snort |
ET TROJAN Storm-2603 AK47C2 HTTP Backdoor CnC Checkin |
rev 1 |
2025-08-01 |
| snort |
ET RETIRED JLORAT CnC Checkin |
rev 3 |
2025-07-14 |
| suricata |
ET RETIRED JLORAT CnC Checkin |
rev 3 |
2025-07-14 |
| snort |
ET TROJAN NordDragonScan CnC Checkin |
rev 1 |
2025-07-08 |
| suricata |
ET MALWARE NordDragonScan CnC Checkin |
rev 1 |
2025-07-08 |
| suricata |
ET MALWARE NordDragonScan Data Exfiltration Attempt |
rev 1 |
2025-07-08 |
| snort |
ET TROJAN NordDragonScan Data Exfiltration Attempt |
rev 1 |
2025-07-08 |
| snort |
ET TROJAN Myth Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-07-01 |
| suricata |
ET MALWARE Myth Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-07-01 |
| suricata |
ET MALWARE Myth Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-07-01 |
| snort |
ET TROJAN Myth Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-07-01 |
| snort |
ET TROJAN BitterAPT Kiwi2.0 Data Exfiltration Attempt |
rev 1 |
2025-06-30 |
| suricata |
ET MALWARE BitterAPT Kiwi2.0 Data Exfiltration Attempt |
rev 1 |
2025-06-30 |
| snort |
ET TROJAN zgRAT / PureLogs CnC Server Connection M3 |
rev 1 |
2025-06-27 |
| suricata |
ET MALWARE zgRAT / PureLogs CnC Server Connection M3 |
rev 1 |
2025-06-27 |
| suricata |
ET MALWARE Diamotrix POST Request M3 |
rev 1 |
2025-06-20 |
| snort |
ET TROJAN Adaptix C2 X-Beacon-Id HTTP Header Observed |
rev 1 |
2025-06-18 |
| snort |
ET TROJAN Adaptix C2 Default User-Agent Observed |
rev 1 |
2025-06-18 |
| suricata |
ET MALWARE Adaptix C2 X-Beacon-Id HTTP Header Observed |
rev 1 |
2025-06-18 |
| suricata |
ET MALWARE Adaptix C2 Default User-Agent Observed |
rev 1 |
2025-06-18 |
| suricata |
ET MALWARE SVCStealer CnC Checkin Confirmation |
rev 1 |
2025-06-09 |
| snort |
ET TROJAN SVCStealer CnC Checkin Confirmation |
rev 1 |
2025-06-09 |
| snort |
ET TROJAN Diamotrix Clipper POST Request M1 |
rev 1 |
2025-06-05 |
| suricata |
ET MALWARE Diamotrix Clipper POST Request M1 |
rev 1 |
2025-06-05 |
| suricata |
ET MALWARE CHERRYSPY.Backdoor Russia APT28 Key Exchange Response |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN CHERRYSPY.Backdoor Russia APT28 Initial Key Exchange |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN CHERRYSPY.Backdoor Russia APT28 Key Exchange Response |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN HATVIBE.loader Russia APT28 HTTP PUT Request |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE CHERRYSPY.Backdoor Russia APT28 Initial Key Exchange |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE HATVIBE.loader Russia APT28 HTTP PUT Request |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN SMOKEDHAM/Thundershell CnC Checkin |
rev 1 |
2025-05-14 |
| suricata |
ET MALWARE SMOKEDHAM/Thundershell CnC Checkin |
rev 1 |
2025-05-14 |
| snort |
ET TROJAN VKeylogger CnC Checkin |
rev 1 |
2025-05-07 |
| suricata |
ET MALWARE VKeylogger CnC Checkin |
rev 1 |
2025-05-07 |
| snort |
ET TROJAN CHStealer getshortinfo Command CnC Checkin |
rev 1 |
2025-04-17 |
| suricata |
ET MALWARE CHStealer checkping Command CnC Checkin |
rev 1 |
2025-04-17 |
| snort |
ET TROJAN CHStealer checkping Command CnC Checkin |
rev 1 |
2025-04-17 |
| suricata |
ET MALWARE CHStealer getshortinfo Command CnC Checkin |
rev 1 |
2025-04-17 |
| suricata |
ET MALWARE Unk Loader Host Profiling Data Exfiltration Attempt |
rev 1 |
2025-04-15 |
| snort |
ET TROJAN Unk Loader Host Profiling Data Exfiltration Attempt |
rev 1 |
2025-04-15 |
| suricata |
ET MALWARE Specter Insight Beacon CnC Checkin M3 |
rev 1 |
2025-04-14 |
| snort |
ET TROJAN Specter Insight Beacon CnC Checkin M3 |
rev 1 |
2025-04-14 |
| suricata |
ET MALWARE Specter Insight Beacon CnC Checkin M2 |
rev 1 |
2025-04-14 |
| snort |
ET TROJAN Specter Insight Beacon CnC Checkin M2 |
rev 1 |
2025-04-14 |
| suricata |
ET MALWARE Trox Stealer System Profiling Data Exfiltration Attempt |
rev 1 |
2025-04-11 |
| snort |
ET TROJAN Trox Stealer System Profiling Data Exfiltration Attempt |
rev 1 |
2025-04-11 |
| snort |
ET TROJAN Divulge Stealer CnC Checkin |
rev 1 |
2025-02-26 |
| suricata |
ET MALWARE Divulge Stealer Data Exfiltration Attempt |
rev 1 |
2025-02-26 |
| snort |
ET TROJAN Divulge Stealer Data Exfiltration Attempt |
rev 1 |
2025-02-26 |
| suricata |
ET MALWARE Divulge Stealer CnC Checkin |
rev 1 |
2025-02-26 |
| suricata |
ET MALWARE CryptBot Data Exfiltration Attempt |
rev 1 |
2025-01-07 |
| snort |
ET TROJAN CryptBot CnC Checkin |
rev 1 |
2025-01-07 |
| suricata |
ET MALWARE CryptBot CnC Checkin |
rev 1 |
2025-01-07 |
| snort |
ET TROJAN CryptBot Data Exfiltration Attempt |
rev 1 |
2025-01-07 |
| suricata |
ET MALWARE DcRAT/Sheet RAT CnC Checkin Using MessagePack |
rev 1 |
2025-01-06 |
| snort |
ET TROJAN DcRAT/Sheet RAT CnC Checkin Using MessagePack |
rev 1 |
2025-01-06 |
| suricata |
ET MALWARE QuickResponseC2 Default Tasking Struct |
rev 1 |
2024-12-10 |
| snort |
ET TROJAN QuickResponseC2 Default Tasking Struct |
rev 1 |
2024-12-10 |
| suricata |
ET MALWARE QuickResponseC2 Default Response Struct |
rev 1 |
2024-12-10 |
| snort |
ET TROJAN QuickResponseC2 Default Response Struct |
rev 1 |
2024-12-10 |
| snort |
ET TROJAN Supershell CnC Activity |
rev 1 |
2024-12-07 |
| suricata |
ET MALWARE Supershell CnC Activity |
rev 1 |
2024-12-07 |
| snort |
ET TROJAN IP2B Trojan Communication Protocol detected |
rev 4 |
2024-12-05 |
| suricata |
ET RETIRED PoisonIvy HTTP CnC Beacon |
rev 5 |
2024-12-05 |
| suricata |
ET RETIRED Backdoor.Win32.RShot Checkin |
rev 2 |
2024-12-05 |
| snort |
ET RETIRED W32.Blackshades/Shadesrat Backdoor CnC Beacon |
rev 2 |
2024-12-05 |
| snort |
ET RETIRED PoisonIvy HTTP CnC Beacon |
rev 2 |
2024-12-05 |
| suricata |
ET RETIRED W32.Blackshades/Shadesrat Backdoor CnC Beacon |
rev 5 |
2024-12-05 |
| suricata |
ET MALWARE IP2B Trojan Communication Protocol detected |
rev 4 |
2024-12-05 |
| snort |
ET RETIRED Backdoor.Win32.RShot Checkin |
rev 2 |
2024-12-05 |
| suricata |
ET RETIRED Night Dragon CnC Beacon Outbound |
rev 5 |
2024-12-03 |
| snort |
ET RETIRED Night Dragon CnC Beacon Outbound |
rev 5 |
2024-12-03 |
| snort |
ET TROJAN W32/InstallRex.Adware Report CnC Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN MSIL/Adload.AT Beacon |
rev 7 |
2024-11-28 |
| snort |
ET TROJAN Nivesro Cheat CnC Activity M1 |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN DealPly Adware CnC Beacon 4 |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN W32/PicColor Adware CnC Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN W32/InstallRex.Adware Initial CnC Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN DealPly Adware CnC Beacon 2 |
rev 4 |
2024-11-28 |
| snort |
ET TROJAN PUP TheSZ AutoUpdate CnC Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN SoundCloud Downloader Install Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN NivesroCheat CnC Activity M2 |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN MALWARE W32/WinWrapper.Adware POST CnC Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN PUP Win32/Conduit.SearchProtect.O CnC Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN DealPly Adware CnC Beacon 3 |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN RelevantKnowledge Adware CnC Beacon |
rev 4 |
2024-11-28 |
| snort |
ET TROJAN W32/Softpulse PUP Install Failed Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN W32/Stan Malvertising.Dropper CnC Beacon |
rev 3 |
2024-11-28 |
| snort |
ET TROJAN W32/RocketfuelNextUp.Adware CnC Beacon |
rev 4 |
2024-11-28 |
| snort |
ET TROJAN DealPly Adware CnC Beacon |
rev 5 |
2024-11-28 |
| snort |
ET TROJAN W32/PullUpdate.Adware CnC Beacon |
rev 6 |
2024-11-28 |
| snort |
ET TROJAN Glove Stealer Data Exfiltration Attempt |
rev 1 |
2024-11-22 |
| suricata |
ET MALWARE Glove Stealer Data Exfiltration Attempt |
rev 1 |
2024-11-22 |
| suricata |
ET MALWARE Havoc Demon CnC Request |
rev 1 |
2024-10-08 |
| snort |
ET TROJAN Havoc Demon CnC Request |
rev 1 |
2024-10-07 |
| snort |
ET TROJAN Possible SSLoad Interactive Shell Connection |
rev 2 |
2024-09-13 |
| snort |
ET TROJAN TA452 Trojan CnC Checkin M2 |
rev 1 |
2024-08-29 |
| suricata |
ET MALWARE TA452 Trojan CnC Checkin M2 |
rev 1 |
2024-08-29 |
| snort |
ET TROJAN TA452 Trojan CnC Checkin M1 |
rev 1 |
2024-08-29 |
| suricata |
ET MALWARE TA452 Trojan CnC Checkin M1 |
rev 1 |
2024-08-29 |
| suricata |
ET MALWARE Covenant .NET Framework SSL/TLS Certificate Observed |
rev 2 |
2024-07-22 |
| suricata |
ET MALWARE Win32/Kryptik_AGen.DOP C2 Checkin |
rev 1 |
2024-07-19 |
| snort |
ET TROJAN Win32/Kryptik_AGen.DOP C2 Checkin |
rev 1 |
2024-07-19 |
| sigma |
Network Communication Initiated To Portmap.IO Domain |
test |
2024-05-31 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server] |
rev 6 |
2024-05-21 |
| suricata |
ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Anatsa Checkin |
rev 6 |
2024-05-04 |
| suricata |
ET MALWARE Ransomware Locky CnC Beacon 4 21 May |
rev 5 |
2024-05-04 |
| suricata |
ET MALWARE Fileless infection dropped by EK CnC Beacon |
rev 6 |
2024-05-04 |
| suricata |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Acecard.c Checkin |
rev 8 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Android/FakeKakao checkin 2 |
rev 6 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Android/FakeKakao checkin 3 |
rev 6 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU Checkin |
rev 6 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a CnC Beacon |
rev 7 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba.m Checkin |
rev 6 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin 2 |
rev 7 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Joker Checkin |
rev 6 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Android/FakeKakao checkin 1 |
rev 6 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Android/Spy.Agent.AOX Checkin |
rev 6 |
2024-05-02 |
| suricata |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin |
rev 7 |
2024-05-02 |
| suricata |
ET MALWARE TeleBots VBS Backdoor CnC Beacon 1 |
rev 5 |
2024-05-01 |
| suricata |
ET ADWARE_PUP DealPly Adware CnC Beacon |
rev 8 |
2024-05-01 |
| suricata |
ET MOBILE_MALWARE Android/Comll.Banker RAT CnC Beacon |
rev 6 |
2024-05-01 |
| suricata |
ET MOBILE_MALWARE Android/BasBanke CnC Checkin |
rev 4 |
2024-05-01 |
| suricata |
ET MALWARE CoinVault CnC Beacon M1 |
rev 6 |
2024-05-01 |
| suricata |
ET ADWARE_PUP W32/RocketfuelNextUp.Adware CnC Beacon |
rev 8 |
2024-05-01 |
| suricata |
ET ADWARE_PUP MALWARE W32/WinWrapper.Adware POST CnC Beacon |
rev 8 |
2024-05-01 |
| suricata |
ET ADWARE_PUP DealPly Adware CnC Beacon 4 |
rev 6 |
2024-05-01 |
| suricata |
ET ADWARE_PUP DealPly Adware CnC Beacon 3 |
rev 6 |
2024-05-01 |
| suricata |
ET MALWARE Win32/TrojanProxy.JpiProx.B CnC Beacon 2 |
rev 6 |
2024-05-01 |
| suricata |
ET MOBILE_MALWARE Android/Kemoge Checkin |
rev 6 |
2024-05-01 |
| suricata |
ET MALWARE Monsoon Tinytyphon CnC Beacon GET |
rev 6 |
2024-05-01 |
| suricata |
ET MALWARE Possible iKittens OSX MacDownloader CNC Beacon |
rev 5 |
2024-05-01 |
| suricata |
ET MOBILE_MALWARE Android/Opfake.A Country CnC Beacon |
rev 10 |
2024-05-01 |
| suricata |
ET ADWARE_PUP DealPly Adware CnC Beacon 2 |
rev 7 |
2024-05-01 |
| suricata |
ET MALWARE Matryoshka CnC Beacon 1 |
rev 6 |
2024-05-01 |
| snort |
ET TROJAN Vawtrak HTTP CnC Beacon |
rev 9 |
2024-05-01 |
| suricata |
ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon |
rev 10 |
2024-05-01 |
| suricata |
ET MOBILE_MALWARE Android/Locker.B Checkin 1 |
rev 6 |
2024-05-01 |
| suricata |
ET MALWARE Vawtrak HTTP CnC Beacon |
rev 12 |
2024-05-01 |
| suricata |
ET MALWARE W32/Qakbot.Bot Version 8 CnC Beacon |
rev 6 |
2024-04-30 |
| suricata |
ET MALWARE APT.Fwits CnC Beacon M1 |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE PunkeyPOS HTTP CnC Beacon 1 |
rev 6 |
2024-04-30 |
| suricata |
ET MALWARE Win32/Injector.BXEW Variant HTTP CnC Beacon 1 |
rev 6 |
2024-04-30 |
| suricata |
ET MALWARE PunkeyPOS HTTP CnC Beacon 4 |
rev 6 |
2024-04-30 |
| suricata |
ET MALWARE W32/Farfli.BHQ!tr Dropper CnC Beacon 2 |
rev 7 |
2024-04-30 |
| suricata |
ET MOBILE_MALWARE Android/Kemoge Checkin 2 |
rev 5 |
2024-04-30 |
| suricata |
ET MOBILE_MALWARE Kimsuky AppleSeed CnC Checkin M2 |
rev 3 |
2024-04-30 |
| suricata |
ET MALWARE Win32/TrojanProxy.JpiProx.B CnC Beacon 1 |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE TeleBots BCS-server CnC Beacon |
rev 5 |
2024-04-30 |
| suricata |
ET ADWARE_PUP PUP TheSZ AutoUpdate CnC Beacon |
rev 7 |
2024-04-30 |
| suricata |
ET MOBILE_MALWARE Kimsuky AppleSeed CnC Checkin |
rev 3 |
2024-04-30 |
| suricata |
ET MALWARE Linux/Lady CnC Beacon 2 |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE SuperFish CnC Beacon 1 |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE Ransomware Win32/WinPlock.A CnC Beacon 3 |
rev 7 |
2024-04-30 |
| suricata |
ET MALWARE KeyLogger related to FindPOS CnC Beacon |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE Linux/LuaBot CnC Beacon |
rev 5 |
2024-04-30 |
| suricata |
ET MALWARE Cloud Atlas CnC Beacon |
rev 6 |
2024-04-29 |
| suricata |
ET MALWARE Win32/Ispen BADNEWS CnC Beacon |
rev 6 |
2024-04-29 |
| snort |
ET TROJAN Bookworm CnC Beacon |
rev 2 |
2024-04-29 |
| suricata |
ET MALWARE Win32/Spyder CnC Checkin |
rev 3 |
2024-04-29 |
| suricata |
ET MOBILE_MALWARE Android Vultr Checkin |
rev 5 |
2024-04-29 |
| snort |
ET TROJAN Bookworm CnC Beacon 2 |
rev 3 |
2024-04-29 |
| snort |
ET TROJAN Backdoor.Elise CnC Beacon 2 |
rev 4 |
2024-04-29 |
| suricata |
ET MALWARE AlphaCrypt CnC Beacon 5 |
rev 6 |
2024-04-29 |
| suricata |
ET MALWARE Sakula/Mivast RAT CnC Beacon 6 |
rev 6 |
2024-04-28 |
| suricata |
ET MOBILE_MALWARE Android.Stealthgenie Checkin |
rev 7 |
2024-04-28 |
| suricata |
ET MALWARE Backdoor.Elise CnC Beacon 2 |
rev 8 |
2024-04-28 |
| suricata |
ET MALWARE Backdoor.Elise CnC Beacon 3 M1 |
rev 7 |
2024-04-28 |
| suricata |
ET MALWARE Bookworm CnC Beacon 2 |
rev 6 |
2024-04-28 |
| suricata |
ET MALWARE Ursnif Variant CnC Beacon 3 |
rev 5 |
2024-04-28 |
| suricata |
ET MALWARE Sakula/Mivast RAT CnC Beacon 7 |
rev 7 |
2024-04-28 |
| suricata |
ET MALWARE Yahoyah CnC Beacon |
rev 5 |
2024-04-28 |
| suricata |
ET MALWARE Backdoor.Elise CnC Beacon 3 M2 |
rev 9 |
2024-04-28 |
| suricata |
ET MOBILE_MALWARE Android/Koler.C Checkin |
rev 10 |
2024-04-28 |
| suricata |
ET MALWARE Sakula/Mivast RAT CnC Beacon 3 |
rev 6 |
2024-04-28 |
| suricata |
ET MALWARE Sakula/Mivast RAT CnC Beacon 2 |
rev 6 |
2024-04-28 |
| suricata |
ET MALWARE PunkeyPOS HTTP CnC Beacon Fake UA |
rev 6 |
2024-04-28 |
| suricata |
ET MOBILE_MALWARE iOS/Xsser checking library version |
rev 5 |
2024-04-28 |
| suricata |
ET MALWARE Bookworm CnC Beacon |
rev 6 |
2024-04-28 |
| suricata |
ET MALWARE Mocelpa Client Hello CnC Beacon |
rev 3 |
2024-04-25 |
| suricata |
ET MALWARE Cobalt Strike Beacon Activity |
rev 2 |
2024-04-24 |
| snort |
ET TROJAN FakeAV Variant CnC Beacon |
rev 2 |
2024-04-22 |
| snort |
ET TROJAN DustySky CnC Beacon |
rev 5 |
2024-04-22 |
| suricata |
ET MALWARE [eSentire] Cobalt Strike Beacon |
rev 6 |
2024-04-22 |
| snort |
ET TROJAN PlugX CnC Beacon |
rev 2 |
2024-04-22 |
| suricata |
ET MALWARE OSX/WireLurker CnC Beacon |
rev 6 |
2024-04-21 |
| suricata |
ET MALWARE FighterPOS CnC Beacon 1 |
rev 5 |
2024-04-21 |
| suricata |
ET ADWARE_PUP W32/PicColor Adware CnC Beacon |
rev 7 |
2024-04-21 |
| suricata |
ET MALWARE Linux/Lady CnC Beacon 1 |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE Sednit/APT28/Sofacy Delphocy CnC Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET MOBILE_MALWARE Android/Opfake.A GetTask CnC Beacon |
rev 7 |
2024-04-21 |
| suricata |
ET MALWARE Win32/Injector.BXEW Variant HTTP CnC Beacon 2 |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE Felismus CnC Beacon 1 |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE Win32/Upgilf CnC Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE Win32/Zacom.A CnC Beacon 1 |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE Bitter RAT HTTP CnC Beacon |
rev 4 |
2024-04-21 |
| suricata |
ET ADWARE_PUP W32/Softpulse PUP Install Failed Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE MAGICHOUND.FETCH CnC Beacon |
rev 6 |
2024-04-21 |
| suricata |
ET MALWARE Win32/Teslacrypt Ransomware HTTP CnC Beacon M1 |
rev 8 |
2024-04-21 |
| suricata |
ET MOBILE_MALWARE Worm.AndroidOS.Selfmite.a Checkin |
rev 6 |
2024-04-21 |
| suricata |
ET INFO W32/Installiq.Adware Install Information Beacon |
rev 6 |
2024-04-21 |
| suricata |
ET MALWARE Ransomware Locky CnC Beacon 2 |
rev 6 |
2024-04-21 |
| suricata |
ET MOBILE_MALWARE Android.KorBanker Fake Banking App Install CnC Beacon |
rev 6 |
2024-04-21 |
| suricata |
ET ADWARE_PUP PUP Win32/Conduit.SearchProtect.O CnC Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET MOBILE_MALWARE Android/Locker.B Checkin 2 |
rev 6 |
2024-04-21 |
| suricata |
ET ADWARE_PUP MSIL/Adload.AT Beacon |
rev 9 |
2024-04-21 |
| suricata |
ET ADWARE_PUP W32/PullUpdate.Adware CnC Beacon |
rev 8 |
2024-04-21 |
| suricata |
ET MALWARE W32/Adrom.Backdoor CnC Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET ADWARE_PUP RelevantKnowledge Adware CnC Beacon |
rev 7 |
2024-04-21 |
| suricata |
ET MALWARE Dalexis CnC Beacon |
rev 6 |
2024-04-21 |
| suricata |
ET MALWARE PlugX CnC Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE FakeAV Variant CnC Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE W32/Antifulai.APT CnC Beacon 1 |
rev 7 |
2024-04-21 |
| suricata |
ET MALWARE Emotet CnC Beacon |
rev 5 |
2024-04-21 |
| suricata |
ET MALWARE Operation Buhtrap CnC Beacon 2 |
rev 8 |
2024-04-20 |
| suricata |
ET MALWARE Win32/TrojanDownloader.Delf.BXC CnC Beacon |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE Win32/TrojanDownloader.Delf.BVP Win32/BioData CnC Beacon |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE Patchwork APT CnC Beacon 2 |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE DarkHotel Initial Beacon |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE JavaScriptBackdoor HTTP GET CnC Beacon |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE Ransomware Win32/WinPlock.A CnC Beacon 2 |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE Ransomware Locky CnC Beacon |
rev 8 |
2024-04-20 |
| suricata |
ET MALWARE Ransomware Locky CnC Beacon |
rev 6 |
2024-04-20 |
| suricata |
ET MALWARE W32/Bravix.Dropper CnC Beacon |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE W32/TrojanSpy.MSIL Set Done Day CnC Beacon |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE AlphaCrypt CnC Beacon 3 |
rev 8 |
2024-04-20 |
| suricata |
ET MALWARE Ransomware Win32/WinPlock.A Successfully Installed CnC Beacon |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE W32/LockscreenBEI.Scareware Cnc Beacon |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE Win32/Teslacrypt Ransomware HTTP CnC Beacon M2 |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE W32/TrojanSpy.MSIL Get New MAC CnC Beacon |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE W32/Citadel.Arx Varient CnC Beacon 2 |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE W32/TrojanSpy.MSIL Fetch Time CnC Beacon |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE Sakula/Mivast RAT CnC Beacon 1 |
rev 7 |
2024-04-20 |
| suricata |
ET MALWARE TeleBots VBS Backdoor CnC Beacon 2 |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE APT.Fwits CnC Beacon M2 |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE Win32/Bancos.AMM CnC Beacon |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE DustySky CnC Beacon |
rev 7 |
2024-04-20 |
| suricata |
ET MALWARE PunkeyPOS HTTP CnC Beacon 2 |
rev 7 |
2024-04-20 |
| suricata |
ET MALWARE DarkHotel Downloader CnC Beacon 2 |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE Dooptroop CnC Beacon |
rev 7 |
2024-04-20 |
| suricata |
ET MALWARE CoinVault CnC Beacon M2 |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE Win32/Injector.BXEW Variant HTTP CnC Beacon 3 |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE FighterPOS CnC Beacon 2 |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE W32/Citadel.Arx Variant CnC Beacon 1 |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE W32/TrojanSpy.MSIL Fetch Header CnC Beacon |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE SuperFish CnC Beacon 2 |
rev 7 |
2024-04-20 |
| suricata |
ET MALWARE Bitter RAT HTTP CnC Beacon M2 |
rev 5 |
2024-04-20 |
| suricata |
ET MALWARE Backdoor.Elise CnC Beacon 1 M2 |
rev 12 |
2024-04-20 |
| suricata |
ET MALWARE DarkHotel Downloader CnC Beacon 1 |
rev 4 |
2024-04-20 |
| suricata |
ET MALWARE Linux/Moose HTTP CnC Beacon |
rev 5 |
2024-04-20 |
| snort |
ET TROJAN Possible SSload Interactive Shell whoami Output |
rev 1 |
2024-04-19 |
| suricata |
ET MALWARE Possible SSload Interactive Shell whoami Output |
rev 1 |
2024-04-19 |
| suricata |
ET MALWARE H1N1 Loader CnC Beacon M1 |
rev 6 |
2024-04-19 |
| suricata |
ET MALWARE Possible SSLoad Interactive Shell Connection |
rev 1 |
2024-04-19 |
| suricata |
ET MALWARE H1N1 Loader CnC Beacon M2 |
rev 5 |
2024-04-19 |
| suricata |
ET MALWARE W32/Kazy.325252 Variant CnC Beacon 1 |
rev 6 |
2024-04-18 |
| suricata |
ET MALWARE W32/Kazy.325252 Variant CnC Beacon 2 |
rev 7 |
2024-04-18 |
| snort |
ET TROJAN Fileless infection dropped by EK CnC Beacon |
rev 2 |
2024-04-15 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] |
rev 6 |
2024-04-14 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] |
rev 6 |
2024-04-14 |
| suricata |
ET MALWARE Chthonic CnC Beacon 5 |
rev 9 |
2024-04-14 |
| suricata |
ET MALWARE Win32/Trojan.Agent.AXMO CnC Beacon |
rev 6 |
2024-04-14 |
| suricata |
ET MALWARE Waledac Beacon Traffic Detected |
rev 10 |
2024-04-14 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] |
rev 5 |
2024-04-14 |
| suricata |
ET MOBILE_MALWARE Android.C2P.Qd!c Ransomware CnC Beacon |
rev 7 |
2024-04-14 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Stager 2] |
rev 6 |
2024-04-14 |
| suricata |
ET MALWARE W32/Briba CnC POST Beacon |
rev 7 |
2024-04-14 |
| suricata |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.RedAlert CnC Beacon |
rev 8 |
2024-04-14 |
| suricata |
ET MALWARE Chthonic CnC Beacon 6 |
rev 7 |
2024-04-14 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server] |
rev 6 |
2024-04-14 |
| suricata |
ET MALWARE W32/Symmi Remote File Injector Initial CnC Beacon |
rev 6 |
2024-04-13 |
| suricata |
ET ADWARE_PUP W32/InstallRex.Adware Report CnC Beacon |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE Downloader.Win32.Small CnC Beacon |
rev 9 |
2024-04-13 |
| suricata |
ET MOBILE_MALWARE Android Syria-Twitter Checkin |
rev 5 |
2024-04-13 |
| suricata |
ET MALWARE W32/Hyteod.Downloader CnC Beacon |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE W32/Kbot.Backdoor Variant CnC Beacon |
rev 6 |
2024-04-13 |
| suricata |
ET MALWARE W32/Hicrazyk.A Downloader Install CnC Beacon |
rev 10 |
2024-04-13 |
| suricata |
ET MALWARE Covenant Framework Default HTTP Beacon |
rev 3 |
2024-04-13 |
| suricata |
ET MALWARE W32/Asprox Passgrub POST CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/Asprox.ClickFraudBot CnC Beacon |
rev 5 |
2024-04-12 |
| suricata |
ET MALWARE W32/Ke3chang.Snake.APT Campaign CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/Ke3chang.MyWeb.APT Eourdegh Campaign CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/Syndicasec.Backdoor CnC Beacon |
rev 6 |
2024-04-12 |
| suricata |
ET MALWARE W32/24x7Help.ScareWare CnC Beacon |
rev 5 |
2024-04-12 |
| suricata |
ET MALWARE W32/Neverquest.InfoStealer Configuration Request CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/SpeedingUpMyPC.Rootkit Successful Install GET Type CnC Beacon |
rev 8 |
2024-04-12 |
| suricata |
ET MOBILE_MALWARE Android/FakeAhnAV.A CnC Beacon |
rev 5 |
2024-04-12 |
| suricata |
ET MALWARE W32/PointOfSales.Misc CnC Beacon |
rev 5 |
2024-04-12 |
| suricata |
ET MALWARE W32/Ke3chang.MovieStar.APT Campaign CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/Banload.VZS Banker POST CnC Beacon 2 |
rev 4 |
2024-04-12 |
| suricata |
ET MOBILE_MALWARE Android Spyware Dowgin Checkin |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/SpeedingUpMyPC.Rootkit Install CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/SpeedingUpMyPC.Rootkit CnC Beacon |
rev 5 |
2024-04-12 |
| suricata |
ET MALWARE W32/Karagany.Downloader CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/Ke3chang.MyWeb.APT Campaign CnC Beacon |
rev 4 |
2024-04-12 |
| suricata |
ET MOBILE_MALWARE CoolReaper CnC Beacon 2 |
rev 5 |
2024-04-12 |
| suricata |
ET MALWARE W32/Zemra.DDoS.Bot Variant CnC Beacon |
rev 5 |
2024-04-12 |
| suricata |
ET MALWARE W32/Ke3chang.Dream.APT Campaign CnC Beacon 2 |
rev 4 |
2024-04-12 |
| suricata |
ET MALWARE W32/Asprox php.dll.crp POST CnC Beacon |
rev 6 |
2024-04-12 |
| suricata |
ET MALWARE Win32/LockScreen CnC Beacon 2 |
rev 6 |
2024-04-07 |
| suricata |
ET MALWARE [CrowdStrike] ANCHOR PANDA - Adobe Gh0st Beacon |
rev 3 |
2024-04-07 |
| suricata |
ET MALWARE LankerBoy HTTP CnC Beacon |
rev 6 |
2024-04-07 |
| suricata |
ET ADWARE_PUP W32/Stan Malvertising.Dropper CnC Beacon |
rev 6 |
2024-04-07 |
| suricata |
ET MALWARE W32/Siggen.Dropper CnC Beacon |
rev 5 |
2024-04-07 |
| suricata |
ET MALWARE Backdoor.Elise CnC Beacon 2 M2 |
rev 7 |
2024-04-06 |
| suricata |
ET MALWARE Win32/HydraCrypt CnC Beacon 1 |
rev 6 |
2024-04-06 |
| suricata |
ET MALWARE APT Lurker POST CnC Beacon |
rev 9 |
2024-04-06 |
| suricata |
ET MALWARE CozyCar V2 CnC Beacon |
rev 6 |
2024-04-06 |
| suricata |
ET MALWARE Operation Interception Beacon |
rev 3 |
2024-04-04 |
| suricata |
ET MALWARE Cobalt Strike Beacon Observed |
rev 5 |
2024-04-04 |
| suricata |
ET ADWARE_PUP NivesroCheat CnC Activity M2 |
rev 4 |
2024-04-04 |
| suricata |
ET ADWARE_PUP Nivesro Cheat CnC Activity M1 |
rev 3 |
2024-04-04 |
| suricata |
ET MALWARE Cobalt Strike Beacon Activity |
rev 3 |
2024-04-04 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 2] |
rev 5 |
2024-04-04 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 3] |
rev 5 |
2024-04-04 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] |
rev 5 |
2024-04-04 |
| suricata |
ET MALWARE Matanbuchus Loader CnC M2 |
rev 4 |
2024-03-26 |
| suricata |
ET MALWARE 000Stealer CnC Checkin |
rev 2 |
2024-03-26 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.SSL.BEACON.[CSBundle Ajax] |
rev 3 |
2024-03-25 |
| suricata |
ET MALWARE W32/BlackEnergy Dirconf CnC Beacon |
rev 5 |
2024-03-25 |
| suricata |
ET MALWARE W32/Banload.VZS Banker POST CnC Beacon 1 |
rev 5 |
2024-03-25 |
| suricata |
ET MALWARE Zeus.Downloader Campaign Unknown Initial CnC Beacon |
rev 7 |
2024-03-25 |
| suricata |
ET MALWARE BOUNCEBEAM Backdoor CnC Activity |
rev 2 |
2024-03-25 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] |
rev 4 |
2024-03-25 |
| snort |
ET MOBILE_MALWARE Trojan-Dropper.AndroidOS.Anatsa Checkin |
rev 2 |
2024-03-22 |
| snort |
ET MOBILE_MALWARE Android Vultr Checkin |
rev 2 |
2024-03-21 |
| suricata |
ET MALWARE [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message Header Local |
rev 4 |
2024-03-15 |
| suricata |
ET MALWARE Linux/Moose NAT Traversal CnC Beacon - Multiple Tunnel |
rev 4 |
2024-03-14 |
| suricata |
ET MALWARE Linux/Moose NAT Traversal CnC Beacon - Sleep |
rev 4 |
2024-03-14 |
| suricata |
ET MALWARE Linux/LuaBot CnC Beacon Response |
rev 3 |
2024-03-14 |
| suricata |
ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon Response |
rev 4 |
2024-03-14 |
| suricata |
ET MALWARE WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related |
rev 5 |
2024-03-14 |
| suricata |
ET MALWARE Linux/Moose NAT Traversal CnC Beacon set |
rev 3 |
2024-03-14 |
| suricata |
ET MALWARE [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message |
rev 4 |
2024-03-14 |
| suricata |
ET MALWARE OSX/WireLurker CnC Beacon |
rev 5 |
2024-03-14 |
| suricata |
ET MALWARE Win32/Spyder Successful CnC Checkin |
rev 2 |
2024-03-14 |
| suricata |
ET MALWARE CozyDuke APT HTTP CnC Beacon Response |
rev 4 |
2024-03-14 |
| suricata |
ET MALWARE APT28 DealersChoice CnC Beacon Response |
rev 3 |
2024-03-14 |
| suricata |
ET MALWARE WEBC2-KT3 Intial Connection Beacon APT1 Related |
rev 3 |
2024-03-14 |
| suricata |
ET MALWARE W32/Eclipse.DDOSBot CnC Beacon Response |
rev 4 |
2024-03-13 |
| snort |
ET TROJAN Win32/Spyder Sending Info to CnC |
rev 2 |
2024-03-13 |
| suricata |
ET MALWARE Win32/Spyder Sending Info to CnC |
rev 2 |
2024-03-13 |
| snort |
ET TROJAN Win32/Spyder CnC Checkin |
rev 2 |
2024-03-13 |
| suricata |
ET MALWARE W32/ServStart.Variant CnC Beacon |
rev 4 |
2024-03-10 |
| suricata |
ET MALWARE FakeAV Win32/Antivirus2008 CnC Beacon |
rev 10 |
2024-03-10 |
| suricata |
ET MOBILE_MALWARE Android.HongTouTou Checkin |
rev 4 |
2024-03-08 |
| sigma |
OpenCanary - TFTP Request |
test |
2024-03-08 |
| suricata |
ET MALWARE [Fireeye] Backdoor.BEACON M6 |
rev 3 |
2024-03-07 |
| suricata |
ET MALWARE Bitter RAT TCP CnC Beacon |
rev 2 |
2024-03-07 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] |
rev 4 |
2024-03-07 |
| suricata |
ET EXPLOIT Possible DOUBLEPULSAR Beacon Response |
rev 3 |
2024-03-07 |
| suricata |
ET MALWARE [Fireeye] Backdoor.BEACON M4 |
rev 3 |
2024-03-07 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server] |
rev 4 |
2024-03-07 |
| suricata |
ET MALWARE [Fireeye] Backdoor.BEACON M3 |
rev 3 |
2024-03-07 |
| suricata |
ET MOBILE_MALWARE Android JadeRAT CnC Beacon |
rev 3 |
2024-03-07 |
| suricata |
ET MALWARE [Fireeye] Backdoor.BEACON M5 |
rev 3 |
2024-03-07 |
| suricata |
ET MALWARE Possible APT40/Dadstache Stage 2 Payload Beacon |
rev 3 |
2024-03-07 |
| suricata |
ET MOBILE_MALWARE Android Golden Rat Checkin |
rev 2 |
2024-03-07 |
| suricata |
ET MOBILE_MALWARE Android BatteryBotPro Checkin 2 |
rev 6 |
2024-03-06 |
| suricata |
ET MOBILE_MALWARE iOS/Xsser Checkin |
rev 4 |
2024-03-06 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] |
rev 3 |
2024-01-25 |
| sigma |
Tunneling Tool Execution |
test |
2024-01-18 |
| snort |
ET TROJAN Win32/Spyder Successful CnC Checkin |
rev 1 |
2023-12-15 |
| snort |
ET TROJAN Cobalt Strike Beacon Activity |
rev 3 |
2023-09-12 |
| suricata |
ET MALWARE [DCSO] Andariel CnC Activity, Check String |
rev 1 |
2023-06-05 |
| snort |
ET TROJAN [DCSO] Andariel CnC Activity, Check String |
rev 1 |
2023-06-05 |
| snort |
ET TROJAN APT28 DealersChoice CnC Beacon Response |
rev 1 |
2023-02-16 |
| snort |
ET TROJAN ViperSoftX HTTP CnC Activity |
rev 1 |
2022-12-30 |
| suricata |
ET MALWARE ViperSoftX HTTP CnC Activity |
rev 1 |
2022-12-30 |
| suricata |
ET MALWARE Win32/Loli Stealer CnC Activity |
rev 1 |
2022-07-25 |
| snort |
ET TROJAN Win32/Loli Stealer CnC Activity |
rev 1 |
2022-07-25 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 810 |
rev 1 |
2022-07-01 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 809 |
rev 1 |
2022-07-01 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 809 |
rev 1 |
2022-07-01 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 810 |
rev 1 |
2022-07-01 |
| snort |
ET TROJAN PunkeyPOS HTTP CnC Beacon 2 |
rev 3 |
2022-05-03 |
| snort |
ET TROJAN Possible DANDERSPRITZ HTTP Beacon |
rev 2 |
2022-05-03 |
| snort |
ET TROJAN Backdoor.Elise CnC Beacon 2 M2 |
rev 2 |
2022-05-03 |
| snort |
ET TROJAN [eSentire] Cobalt Strike Beacon |
rev 3 |
2022-05-03 |
| snort |
ET TROJAN 000Stealer CnC Checkin |
rev 2 |
2022-04-22 |
| suricata |
ET MALWARE [PTsecurity] Win32/Remcos RAT Checkin 51 |
rev 2 |
2022-04-18 |
| snort |
ET TROJAN Bitter RAT HTTP CnC Beacon M2 |
rev 3 |
2022-04-18 |
| suricata |
ET MALWARE MSIL/Crimson Rat CnC Exfil |
rev 2 |
2022-04-18 |
| snort |
ET MOBILE_MALWARE Kimsuky AppleSeed CnC Checkin M2 |
rev 2 |
2022-04-18 |
| snort |
ET TROJAN MSIL/Crimson Rat CnC Exfil |
rev 2 |
2022-04-18 |
| snort |
ET TROJAN [PTsecurity] Win32/Remcos RAT Checkin 51 |
rev 2 |
2022-04-18 |
| suricata |
ET MALWARE Win32/Farfli.CUY CnC Server Response |
rev 2 |
2022-04-08 |
| snort |
ET TROJAN Win32/Farfli.CUY CnC Server Response |
rev 1 |
2022-04-08 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 781 |
rev 2 |
2022-03-11 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 781 |
rev 1 |
2022-03-11 |
| snort |
ET TROJAN CobaltStrike DNS Beacon Response |
rev 8 |
2022-03-05 |
| suricata |
ET MALWARE CobaltStrike DNS Beacon Response |
rev 9 |
2022-03-05 |
| snort |
ET TROJAN Matanbuchus Loader CnC M2 |
rev 3 |
2021-12-02 |
| snort |
ET TROJAN VNCStartServer BOT Variant CnC Beacon |
rev 3 |
2021-11-29 |
| suricata |
ET MALWARE VNCStartServer BOT Variant CnC Beacon |
rev 3 |
2021-11-29 |
| sigma |
Equation Group C2 Communication |
test |
2021-11-27 |
| snort |
ET TROJAN Win32/Farfli.CUY KeepAlive M1 |
rev 1 |
2021-11-16 |
| suricata |
ET MALWARE Win32/Farfli.CUY KeepAlive M1 |
rev 1 |
2021-11-16 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 756 |
rev 1 |
2021-10-05 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 756 |
rev 2 |
2021-10-05 |
| snort |
ET TROJAN BOUNCEBEAM Backdoor CnC Activity |
rev 1 |
2021-07-22 |
| suricata |
ET MOBILE_MALWARE PJobRat CnC Checkin |
rev 1 |
2021-07-13 |
| snort |
ET MOBILE_MALWARE PJobRat CnC Checkin |
rev 1 |
2021-07-13 |
| snort |
ET MOBILE_MALWARE Kimsuky AppleSeed CnC Checkin |
rev 1 |
2021-06-01 |
| snort |
ET TROJAN Cobalt Strike Beacon Activity |
rev 2 |
2021-03-22 |
| snort |
ET TROJAN [Fireeye] Backdoor.BEACON M5 |
rev 2 |
2020-12-14 |
| snort |
ET TROJAN [Fireeye] Backdoor.BEACON M1 |
rev 2 |
2020-12-14 |
| snort |
ET TROJAN [Fireeye] Backdoor.BEACON M4 |
rev 2 |
2020-12-14 |
| suricata |
ET MALWARE [Fireeye] Backdoor.BEACON M1 |
rev 2 |
2020-12-14 |
| snort |
ET TROJAN [Fireeye] Backdoor.BEACON M3 |
rev 2 |
2020-12-14 |
| snort |
ET TROJAN [Fireeye] Backdoor.BEACON M6 |
rev 2 |
2020-12-14 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] |
rev 4 |
2020-12-12 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server] |
rev 3 |
2020-12-09 |
| suricata |
ET CURRENT_EVENTS [Fireeye] Backdoor.DNS.BEACON.[CSBundle DNS] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 3] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 2] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Stager 2] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST] |
rev 3 |
2020-12-09 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.SSL.BEACON.[CSBundle Ajax] |
rev 2 |
2020-12-08 |
| snort |
ET CURRENT_EVENTS [Fireeye] Backdoor.DNS.BEACON.[CSBundle DNS] |
rev 2 |
2020-12-08 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 63 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 55 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 60 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 84 |
rev 3 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 67 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 68 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 62 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 84 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 65 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 67 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 66 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 27 |
rev 3 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 57 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 64 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 56 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 28 |
rev 3 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 62 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 109 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 26 |
rev 3 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 59 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 27 |
rev 3 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 26 |
rev 3 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 55 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 68 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 56 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 63 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 30 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 65 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 58 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 29 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 28 |
rev 3 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 60 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 61 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 30 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 61 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 29 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 57 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 54 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 66 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 58 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 64 |
rev 2 |
2020-11-06 |
| snort |
ET TROJAN Win32/Remcos RAT Checkin 109 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 54 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Win32/Remcos RAT Checkin 59 |
rev 2 |
2020-11-06 |
| suricata |
ET MALWARE Miniduke Variant CnC Beacon via WebDAV |
rev 4 |
2020-10-08 |
| suricata |
ET MALWARE Monsoon Tinytyphon CnC Beacon Exfiltrating Docs |
rev 4 |
2020-10-06 |
| suricata |
ET MALWARE W32/Fin4.InfoStealer Uploading User Credentials CnC Beacon |
rev 6 |
2020-09-28 |
| suricata |
ET MALWARE W32/HelloBridge.Backdoor Login CnC Beacon |
rev 4 |
2020-09-24 |
| suricata |
ET MALWARE W32/HelloBridge.Backdoor Register CnC Beacon |
rev 4 |
2020-09-24 |
| suricata |
ET MALWARE W32/Iyus.H Initial CnC Beacon |
rev 5 |
2020-09-18 |
| suricata |
ET MALWARE W32/LetsGo.APT Sleep CnC Beacon |
rev 4 |
2020-09-18 |
| suricata |
ET MALWARE W32/Beebus HTTP POST CnC Beacon |
rev 4 |
2020-09-18 |
| suricata |
ET MALWARE Trojan.Win32.Cosmu.xet CnC Beacon |
rev 5 |
2020-09-10 |
| suricata |
ET MALWARE PLATINUM Dipsind CnC Beacon |
rev 3 |
2020-09-02 |
| suricata |
ET ADWARE_PUP W32/InstallRex.Adware Initial CnC Beacon |
rev 4 |
2020-08-31 |
| suricata |
ET ADWARE_PUP SoundCloud Downloader Install Beacon |
rev 4 |
2020-08-31 |
| suricata |
ET WEB_CLIENT Volexity - JS Sniffer Data Theft Beacon Detected |
rev 3 |
2020-08-25 |
| suricata |
ET MALWARE DPRK HIDDEN COBRA Botnet C2 Host Beacon |
rev 3 |
2020-08-19 |
| suricata |
ET MALWARE Rerdom/Asprox CnC Beacon |
rev 4 |
2020-08-18 |
| suricata |
ET MALWARE W32/Asprox.ClickFraudBot POST CnC Beacon |
rev 5 |
2020-08-17 |
| suricata |
ET MALWARE Possible DANDERSPRITZ HTTP Beacon |
rev 3 |
2020-08-05 |
| suricata |
ET MALWARE MAGICHOUND.RETRIEVER CnC Beacon |
rev 3 |
2020-08-04 |
| suricata |
ET MALWARE CozyCar CnC Beacon |
rev 3 |
2020-08-04 |
| suricata |
ET MALWARE Possible Pegasus/Trident Related HTTP Beacon 2 |
rev 3 |
2020-07-27 |
| suricata |
ET MALWARE Possible Pegasus/Trident Related HTTP Beacon 4 |
rev 4 |
2020-07-27 |
| suricata |
ET MALWARE Possible Pegasus/Trident Related HTTP Beacon 1 |
rev 4 |
2020-07-27 |
| suricata |
ET MOBILE_MALWARE Android/SMSThief.F Banker CnC Beacon |
rev 3 |
2020-05-15 |
| suricata |
ET MALWARE W32/TRCrypt.ULPM Downloader CnC Beacon |
rev 3 |
2020-05-14 |
| suricata |
ET MALWARE W32/Asprox.ClickFraudBot CnC Beacon Acknowledgement |
rev 3 |
2020-04-27 |
| suricata |
ET MALWARE W32/Rshot.Backdoor File Upload CnC Beacon |
rev 3 |
2020-04-27 |
| suricata |
ET MALWARE W32/Downloader.Mevade.FBV CnC Beacon |
rev 4 |
2020-04-27 |
| suricata |
ET MOBILE_MALWARE Android/HeHe.Spy RegisterRequest CnC Beacon |
rev 7 |
2020-04-27 |
| suricata |
ET MOBILE_MALWARE Android/HeHe.Spy GetTaskRequest CnC Beacon |
rev 4 |
2020-04-27 |
| suricata |
ET MOBILE_MALWARE Android/HeHe.Spy LoginRequest CnC Beacon |
rev 6 |
2020-04-27 |
| suricata |
ET MALWARE W32/Liftoh.Downloader Images CnC Beacon |
rev 3 |
2020-04-27 |
| suricata |
ET MALWARE W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon |
rev 4 |
2020-04-27 |
| suricata |
ET MALWARE W32/Liftoh.Downloader Feed404 CnC Beacon |
rev 3 |
2020-04-27 |
| suricata |
ET MOBILE_MALWARE Android/HeHe.Spy ReportRequest CnC Beacon |
rev 7 |
2020-04-27 |
| suricata |
ET MALWARE W32/Trustezeb.C CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE Linux/SSHDoor.A Reporting Backdoor CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/FloatingCloud.Banker CnC Beacon |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32/DownloaderAgent.fajk Successful Infection CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET MALWARE W32/Bilakip.A Downloader API Ping CnC Beacon |
rev 3 |
2020-04-23 |
| suricata |
ET MOBILE_MALWARE Android/Smsilence.A Sending SMS Messages CnC Beacon |
rev 4 |
2020-04-23 |
| suricata |
ET MALWARE W32.Daws/Sanny CnC Initial Beacon |
rev 4 |
2020-04-22 |
| suricata |
ET MALWARE W32/Downloader.FakeFlashPlayer Status.Php CnC Beacon |
rev 3 |
2020-04-22 |
| suricata |
ET MOBILE_MALWARE Android/Ozotshielder.A Checkin |
rev 3 |
2020-04-20 |
| suricata |
ET MOBILE_MALWARE Android Trojan MSO.PJApps checkin 2 |
rev 3 |
2020-04-19 |
| suricata |
ET MOBILE_MALWARE Android Trojan Fake10086 checkin 2 |
rev 3 |
2020-04-19 |
| suricata |
ET MOBILE_MALWARE Android Trojan MSO.PJApps checkin 1 |
rev 6 |
2020-04-19 |
| snort |
ET TROJAN Possible APT40/Dadstache Stage 2 Payload Beacon |
rev 2 |
2020-02-11 |
| suricata |
ET MALWARE VNCStartServer USR Variant CnC Beacon |
rev 3 |
2019-12-02 |
| snort |
ET TROJAN VNCStartServer USR Variant CnC Beacon |
rev 3 |
2019-12-02 |
| snort |
ET MOBILE_MALWARE Android/Geost CnC Checkin |
rev 2 |
2019-10-08 |
| suricata |
ET MALWARE TrochilusRAT CnC Beacon 1 |
rev 4 |
2019-10-08 |
| suricata |
ET MALWARE ZhCAT.HackTool Operation Cleaver HTTP CnC Beacon |
rev 4 |
2019-10-08 |
| suricata |
ET MALWARE PowerShell/Agent.A DNS File Transfer CnC Beacon |
rev 3 |
2019-10-08 |
| suricata |
ET MALWARE W32/Jabberbot.A Trednet XMPP CnC Beacon |
rev 2 |
2019-10-08 |
| suricata |
ET MOBILE_MALWARE Android/Geost CnC Checkin |
rev 1 |
2019-10-08 |
| suricata |
ET MALWARE TrochilusRAT CnC Beacon 2 |
rev 3 |
2019-10-08 |
| suricata |
ET MALWARE njRAT Variant Outbound CnC Beacon |
rev 2 |
2019-09-28 |
| snort |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Joker Checkin |
rev 1 |
2019-09-09 |
| snort |
ET MOBILE_MALWARE Android/Locker.B Checkin 2 |
rev 2 |
2019-09-03 |
| snort |
ET MOBILE_MALWARE Android/Locker.B Checkin 1 |
rev 2 |
2019-09-03 |
| snort |
ET TROJAN PowerShell/Agent.A DNS File Transfer CnC Beacon |
rev 2 |
2019-08-28 |
| snort |
ET MOBILE_MALWARE Android/Spy.Agent.AOX Checkin |
rev 1 |
2019-08-27 |
| snort |
ET TROJAN Covenant Framework Default HTTP Beacon |
rev 2 |
2019-08-04 |
| suricata |
ET WORM W32/Njw0rm CnC Beacon |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE W32/Kegotip CnC Beacon |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE [PTsecurity] DorkBot.Downloader CnC Beacon |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Tsyrval Panda CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE NCSC XAgent itwm beacon v2 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE W32/DoubleTap.APT Downloader CnC Beacon |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Putter Panda 3PARA RAT initial beacon |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE PlugX UDP CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Win32/VB.SDB CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE W32/Dinwod.Dropper Win32/Xtrat.B CnC Beacon |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE NCSC XAgent itwm beacon v1 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Volatile Cedar Win32.Explosive CnC Beacon 3 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Observed UltraVNC CnC Activity |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Carbanak APT CnC Beacon 1 |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE SuperCMD CnC Beacon |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Boaxxe.BR CnC Beacon |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Denisca.A CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Possible Linux/Moose Telnet CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Hawkeye Keylogger SMTP Beacon |
rev 3 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Bulta CnC Beacon |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE W32/SchwSonne CnC Beacon M2 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE FakeM RAT CnC Beacon |
rev 5 |
2019-07-26 |
| suricata |
ET MALWARE Carbanak APT CnC Beacon 2 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Linux/Venom CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MOBILE_MALWARE Android/Code4hk.A Checkin |
rev 2 |
2019-07-26 |
| suricata |
ET MALWARE KeyBoy CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Win32/Denisca.A CnC Beacon 2 |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE Hong Kong SWC Attack PcClient CnC Beacon |
rev 1 |
2019-07-26 |
| suricata |
ET MALWARE MAGICHOUND.LEASH IRC CnC Beacon |
rev 1 |
2019-07-26 |
| snort |
ET TROJAN Linux/Moose NAT Traversal CnC Beacon - Sleep |
rev 2 |
2019-05-29 |
| snort |
ET TROJAN Linux/Moose NAT Traversal CnC Beacon - Multiple Tunnel |
rev 2 |
2019-05-29 |
| snort |
ET MOBILE_MALWARE Android/BasBanke CnC Checkin |
rev 2 |
2019-04-04 |
| snort |
ET TROJAN Sharik/Smoke CnC Beacon 12 |
rev 3 |
2018-11-07 |
| snort |
ET TROJAN NCSC XAgent itwm beacon v1 |
rev 1 |
2018-10-04 |
| snort |
ET TROJAN NCSC XAgent itwm beacon v2 |
rev 1 |
2018-10-04 |
| snort |
ET TROJAN Observed UltraVNC CnC Activity |
rev 2 |
2018-09-21 |
| snort |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin |
rev 2 |
2018-08-13 |
| snort |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a Checkin 2 |
rev 2 |
2018-08-13 |
| snort |
ET MOBILE_MALWARE Trojan-Spy.AndroidOS.CrazyMango.a CnC Beacon |
rev 2 |
2018-08-13 |
| snort |
ET CURRENT_EVENTS Volexity - JS Sniffer Data Theft Beacon Detected |
rev 3 |
2018-07-30 |
| snort |
ET MOBILE_MALWARE Android Golden Rat Checkin |
rev 1 |
2018-07-25 |
| snort |
ET TROJAN [PTsecurity] DorkBot.Downloader CnC Beacon |
rev 3 |
2018-02-05 |
| snort |
ET TROJAN W32/SchwSonne CnC Beacon M2 |
rev 1 |
2018-01-25 |
| snort |
ET TROJAN Win32/TrojanDownloader.Delf.BVP Win32/BioData CnC Beacon |
rev 2 |
2017-11-07 |
| snort |
ET TROJAN W32/Dinwod.Dropper Win32/Xtrat.B CnC Beacon |
rev 5 |
2017-11-07 |
| snort |
ET MOBILE_MALWARE Android JadeRAT CnC Beacon |
rev 1 |
2017-10-23 |
| snort |
ET TROJAN MAGICHOUND.FETCH CnC Beacon |
rev 2 |
2017-09-29 |
| snort |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.RedAlert CnC Beacon |
rev 2 |
2017-09-25 |
| snort |
ET TROJAN DarkHotel Downloader CnC Beacon 1 |
rev 1 |
2017-07-20 |
| snort |
ET TROJAN DarkHotel Downloader CnC Beacon 2 |
rev 1 |
2017-07-20 |
| snort |
ET TROJAN DPRK HIDDEN COBRA Botnet C2 Host Beacon |
rev 2 |
2017-06-15 |
| snort |
ET TROJAN PLATINUM Dipsind CnC Beacon |
rev 1 |
2017-06-09 |
| snort |
ET TROJAN SuperCMD CnC Beacon |
rev 2 |
2017-05-04 |
| snort |
ET MOBILE_MALWARE Android.KorBanker Fake Banking App Install CnC Beacon |
rev 2 |
2017-04-27 |
| snort |
ET EXPLOIT Possible DOUBLEPULSAR Beacon Response |
rev 2 |
2017-04-17 |
| snort |
ET TROJAN W32/Kegotip CnC Beacon |
rev 3 |
2017-04-10 |
| snort |
ET TROJAN Felismus CnC Beacon 1 |
rev 1 |
2017-04-04 |
| snort |
ET MOBILE_MALWARE Android.C2P.Qd!c Ransomware CnC Beacon |
rev 1 |
2017-03-31 |
| snort |
ET MOBILE_MALWARE Android/Opfake.A GetTask CnC Beacon |
rev 3 |
2017-03-29 |
| snort |
ET TROJAN MagikPOS CnC Beacon |
rev 2 |
2017-03-16 |
| snort |
ET MOBILE_MALWARE Android/Comll.Banker RAT CnC Beacon |
rev 2 |
2017-03-09 |
| snort |
ET TROJAN CozyCar CnC Beacon |
rev 1 |
2017-02-17 |
| snort |
ET TROJAN CozyCar V2 CnC Beacon |
rev 1 |
2017-02-17 |
| snort |
ET TROJAN MAGICHOUND.LEASH IRC CnC Beacon |
rev 1 |
2017-02-16 |
| snort |
ET TROJAN MAGICHOUND.RETRIEVER CnC Beacon |
rev 1 |
2017-02-16 |
| snort |
ET TROJAN Miniduke Variant CnC Beacon via WebDAV |
rev 1 |
2017-02-16 |
| snort |
ET TROJAN Possible iKittens OSX MacDownloader CNC Beacon |
rev 1 |
2017-02-07 |
| snort |
ET TROJAN Dooptroop CnC Beacon |
rev 3 |
2017-01-18 |
| snort |
ET TROJAN Linux/Venom CnC Beacon |
rev 1 |
2017-01-11 |
| snort |
ET TROJAN TeleBots VBS Backdoor CnC Beacon 2 |
rev 1 |
2016-12-16 |
| snort |
ET TROJAN TeleBots BCS-server CnC Beacon |
rev 1 |
2016-12-15 |
| snort |
ET TROJAN TeleBots VBS Backdoor CnC Beacon 1 |
rev 1 |
2016-12-15 |
| snort |
ET TROJAN Win32/VB.SDB CnC Beacon |
rev 1 |
2016-11-23 |
| snort |
ET TROJAN Win32/TrojanDownloader.Delf.BXC CnC Beacon |
rev 1 |
2016-11-23 |
| snort |
ET TROJAN Win32/Ispen BADNEWS CnC Beacon |
rev 2 |
2016-11-21 |
| snort |
ET TROJAN KeyBoy CnC Beacon |
rev 1 |
2016-11-18 |
| snort |
ET MOBILE_MALWARE Android.Trojan.HiddenApp.OU Checkin |
rev 1 |
2016-11-15 |
| snort |
ET TROJAN Alphacrypt/TeslaCrypt Ransomware CnC Beacon |
rev 4 |
2016-11-15 |
| snort |
ET TROJAN Sednit/APT28/Sofacy Delphocy CnC Beacon |
rev 1 |
2016-11-08 |
| snort |
ET TROJAN Bitter RAT TCP CnC Beacon |
rev 1 |
2016-10-24 |
| snort |
ET TROJAN Bitter RAT HTTP CnC Beacon |
rev 1 |
2016-10-24 |
| snort |
ET TROJAN Possible Pegasus/Trident Related HTTP Beacon 4 |
rev 2 |
2016-09-06 |
| snort |
ET TROJAN Linux/LuaBot CnC Beacon Response |
rev 1 |
2016-09-06 |
| snort |
ET TROJAN Linux/LuaBot CnC Beacon |
rev 1 |
2016-09-06 |
| snort |
ET TROJAN Possible Pegasus/Trident Related HTTP Beacon 1 |
rev 2 |
2016-08-30 |
| snort |
ET TROJAN Possible Pegasus/Trident Related HTTP Beacon 2 |
rev 1 |
2016-08-26 |
| snort |
ET TROJAN Monsoon Tinytyphon CnC Beacon Exfiltrating Docs |
rev 1 |
2016-08-11 |
| snort |
ET TROJAN Monsoon Tinytyphon CnC Beacon GET |
rev 1 |
2016-08-11 |
| snort |
ET TROJAN Linux/Lady CnC Beacon 1 |
rev 1 |
2016-08-10 |
| snort |
ET TROJAN Linux/Lady CnC Beacon 2 |
rev 1 |
2016-08-10 |
| snort |
ET TROJAN Patchwork APT CnC Beacon 2 |
rev 1 |
2016-06-02 |
| snort |
ET TROJAN Ransomware Locky CnC Beacon 4 21 May |
rev 1 |
2016-05-31 |
| snort |
ET TROJAN Hawkeye Keylogger SMTP Beacon |
rev 2 |
2016-05-26 |
| snort |
ET TROJAN Win32/Upgilf CnC Beacon |
rev 1 |
2016-05-05 |
| snort |
ET TROJAN Ransomware Locky CnC Beacon 2 |
rev 1 |
2016-04-27 |
| snort |
ET TROJAN APT.Fwits CnC Beacon M2 |
rev 1 |
2016-04-25 |
| snort |
ET TROJAN APT.Fwits CnC Beacon M1 |
rev 1 |
2016-04-25 |
| snort |
ET MOBILE_MALWARE Android/Opfake.A Country CnC Beacon |
rev 4 |
2016-04-08 |
| snort |
ET TROJAN Ransomware Locky CnC Beacon |
rev 4 |
2016-03-28 |
| snort |
ET TROJAN Ransomware Locky CnC Beacon |
rev 4 |
2016-03-21 |
| snort |
ET TROJAN W32/Syndicasec.Backdoor CnC Beacon |
rev 2 |
2016-03-11 |
| snort |
ET TROJAN FakeM RAT CnC Beacon |
rev 5 |
2016-01-14 |
| snort |
ET TROJAN TrochilusRAT CnC Beacon 1 |
rev 3 |
2016-01-13 |
| snort |
ET TROJAN TrochilusRAT CnC Beacon 2 |
rev 2 |
2016-01-13 |
| snort |
ET TROJAN Win32/Bulta CnC Beacon |
rev 2 |
2016-01-09 |
| snort |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Acecard.c Checkin |
rev 3 |
2015-12-21 |
| snort |
ET TROJAN Alphacrypt/TeslaCrypt Ransomware CnC Beacon Response |
rev 5 |
2015-12-18 |
| snort |
ET TROJAN AlphaCrypt CnC Beacon 5 |
rev 3 |
2015-12-18 |
| snort |
ET TROJAN Matryoshka CnC Beacon 1 |
rev 1 |
2015-11-25 |
| snort |
ET TROJAN Operation Buhtrap CnC Beacon 2 |
rev 2 |
2015-11-13 |
| snort |
ET MOBILE_MALWARE Android/Kemoge Checkin |
rev 1 |
2015-10-08 |
| snort |
ET MOBILE_MALWARE Android/Kemoge Checkin 2 |
rev 1 |
2015-10-08 |
| snort |
ET TROJAN Ransomware Win32/WinPlock.A CnC Beacon 2 |
rev 3 |
2015-09-30 |
| snort |
ET TROJAN Ransomware Win32/WinPlock.A CnC Beacon 3 |
rev 3 |
2015-09-30 |
| snort |
ET MOBILE_MALWARE Android/Koler.C Checkin |
rev 5 |
2015-09-30 |
| snort |
ET TROJAN Ransomware Win32/WinPlock.A Successfully Installed CnC Beacon |
rev 2 |
2015-09-30 |
| snort |
ET TROJAN Ursnif Variant CnC Beacon 3 |
rev 1 |
2015-09-23 |
| snort |
ET TROJAN PlugX UDP CnC Beacon |
rev 1 |
2015-09-17 |
| snort |
ET TROJAN Cobalt Strike Beacon Observed |
rev 1 |
2015-09-09 |
| snort |
ET TROJAN Win32/Boaxxe.BR CnC Beacon |
rev 4 |
2015-09-08 |
| snort |
ET TROJAN AlphaCrypt CnC Beacon 3 |
rev 4 |
2015-08-27 |
| snort |
ET TROJAN DarkHotel Initial Beacon |
rev 1 |
2015-08-11 |
| snort |
ET TROJAN Sakula/Mivast RAT CnC Beacon 7 |
rev 2 |
2015-08-01 |
| snort |
ET TROJAN Sakula/Mivast RAT CnC Beacon 6 |
rev 1 |
2015-08-01 |
| snort |
ET TROJAN Tsyrval Panda CnC Beacon |
rev 1 |
2015-07-20 |
| snort |
ET TROJAN Win32/Bancos.AMM CnC Beacon |
rev 3 |
2015-07-20 |
| snort |
ET TROJAN W32/Banload.VZS Banker POST CnC Beacon 1 |
rev 1 |
2015-07-10 |
| snort |
ET TROJAN W32/Banload.VZS Banker POST CnC Beacon 2 |
rev 1 |
2015-07-10 |
| snort |
ET MOBILE_MALWARE Android BatteryBotPro Checkin 2 |
rev 2 |
2015-07-09 |
| snort |
ET TROJAN Win32/Denisca.A CnC Beacon 2 |
rev 1 |
2015-07-07 |
| snort |
ET TROJAN Win32/Denisca.A CnC Beacon |
rev 1 |
2015-07-07 |
| snort |
ET TROJAN Mocelpa Client Hello CnC Beacon |
rev 1 |
2015-07-06 |
| snort |
ET TROJAN W32/Kazy.325252 Variant CnC Beacon 1 |
rev 2 |
2015-07-06 |
| snort |
ET TROJAN W32/Kazy.325252 Variant CnC Beacon 2 |
rev 2 |
2015-07-06 |
| snort |
ET TROJAN Backdoor.Elise CnC Beacon 1 M2 |
rev 4 |
2015-06-23 |
| snort |
ET TROJAN Backdoor.Elise CnC Beacon 3 M1 |
rev 3 |
2015-06-23 |
| snort |
ET TROJAN Backdoor.Elise CnC Beacon 3 M2 |
rev 2 |
2015-06-19 |
| snort |
ET TROJAN Win32/Zacom.A CnC Beacon 1 |
rev 1 |
2015-06-09 |
| snort |
ET TROJAN Sakula/Mivast RAT CnC Beacon 1 |
rev 4 |
2015-06-08 |
| snort |
ET TROJAN Sakula/Mivast RAT CnC Beacon 2 |
rev 1 |
2015-06-08 |
| snort |
ET TROJAN Sakula/Mivast RAT CnC Beacon 3 |
rev 1 |
2015-06-08 |
| snort |
ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba.m Checkin |
rev 1 |
2015-06-05 |
| snort |
ET TROJAN Linux/Moose HTTP CnC Beacon |
rev 2 |
2015-05-27 |
| snort |
ET TROJAN Possible Linux/Moose Telnet CnC Beacon |
rev 1 |
2015-05-26 |
| snort |
ET TROJAN Linux/Moose NAT Traversal CnC Beacon set |
rev 1 |
2015-05-26 |
| snort |
ET TROJAN H1N1 Loader CnC Beacon M2 |
rev 1 |
2015-05-22 |
| snort |
ET TROJAN H1N1 Loader CnC Beacon M1 |
rev 1 |
2015-05-22 |
| snort |
ET TROJAN JavaScriptBackdoor HTTP GET CnC Beacon |
rev 1 |
2015-05-21 |
| snort |
ET TROJAN Yahoyah CnC Beacon |
rev 1 |
2015-05-18 |
| snort |
ET TROJAN njRAT Variant Outbound CnC Beacon |
rev 1 |
2015-05-05 |
| snort |
ET TROJAN CozyDuke APT HTTP CnC Beacon Response |
rev 1 |
2015-04-22 |
| snort |
ET TROJAN PunkeyPOS HTTP CnC Beacon 4 |
rev 1 |
2015-04-17 |
| snort |
ET TROJAN PunkeyPOS HTTP CnC Beacon Fake UA |
rev 1 |
2015-04-17 |
| snort |
ET TROJAN PunkeyPOS HTTP CnC Beacon 1 |
rev 1 |
2015-04-17 |
| snort |
ET TROJAN Dalexis CnC Beacon |
rev 3 |
2015-04-17 |
| snort |
ET TROJAN FighterPOS CnC Beacon 2 |
rev 1 |
2015-04-16 |
| snort |
ET TROJAN FighterPOS CnC Beacon 1 |
rev 1 |
2015-04-16 |
| snort |
ET TROJAN W32/Farfli.BHQ!tr Dropper CnC Beacon 2 |
rev 1 |
2015-04-15 |
| snort |
ET TROJAN CoinVault CnC Beacon M2 |
rev 1 |
2015-04-14 |
| snort |
ET TROJAN CoinVault CnC Beacon M1 |
rev 1 |
2015-04-14 |
| snort |
ET TROJAN LankerBoy HTTP CnC Beacon |
rev 1 |
2015-04-14 |
| snort |
ET TROJAN Win32/Injector.BXEW Variant HTTP CnC Beacon 1 |
rev 1 |
2015-04-02 |
| snort |
ET TROJAN Win32/Injector.BXEW Variant HTTP CnC Beacon 2 |
rev 1 |
2015-04-02 |
| snort |
ET TROJAN Win32/Injector.BXEW Variant HTTP CnC Beacon 3 |
rev 1 |
2015-04-02 |
| snort |
ET TROJAN Volatile Cedar Win32.Explosive CnC Beacon 3 |
rev 1 |
2015-03-31 |
| snort |
ET TROJAN Win32/Teslacrypt Ransomware HTTP CnC Beacon M1 |
rev 3 |
2015-03-27 |
| snort |
ET TROJAN Win32/TrojanProxy.JpiProx.B CnC Beacon 2 |
rev 1 |
2015-03-25 |
| snort |
ET TROJAN Win32/TrojanProxy.JpiProx.B CnC Beacon 1 |
rev 1 |
2015-03-25 |
| snort |
ET TROJAN KeyLogger related to FindPOS CnC Beacon |
rev 1 |
2015-03-21 |
| snort |
ET TROJAN Win32/Teslacrypt Ransomware HTTP CnC Beacon M2 |
rev 2 |
2015-03-20 |
| snort |
ET TROJAN Carbanak APT CnC Beacon 1 |
rev 2 |
2015-02-20 |
| snort |
ET TROJAN SuperFish CnC Beacon 2 |
rev 2 |
2015-02-20 |
| snort |
ET TROJAN SuperFish CnC Beacon 1 |
rev 1 |
2015-02-20 |
| snort |
ET TROJAN Carbanak APT CnC Beacon 2 |
rev 1 |
2015-02-17 |
| snort |
ET MOBILE_MALWARE Android Syria-Twitter Checkin |
rev 1 |
2015-02-03 |
| snort |
ET MOBILE_MALWARE Android/SMSThief.F Banker CnC Beacon |
rev 1 |
2015-02-03 |
| snort |
ET TROJAN W32/Asprox php.dll.crp POST CnC Beacon |
rev 4 |
2015-02-02 |
| snort |
ET TROJAN W32/Adrom.Backdoor CnC Beacon |
rev 1 |
2015-01-23 |
| snort |
ET TROJAN Hong Kong SWC Attack PcClient CnC Beacon |
rev 1 |
2015-01-13 |
| snort |
ET TROJAN ZhCAT.HackTool Operation Cleaver HTTP CnC Beacon |
rev 3 |
2014-12-17 |
| snort |
ET MOBILE_MALWARE CoolReaper CnC Beacon 2 |
rev 1 |
2014-12-17 |
| snort |
ET TROJAN W32/TRCrypt.ULPM Downloader CnC Beacon |
rev 1 |
2014-12-16 |
| snort |
ET TROJAN W32/Fin4.InfoStealer Uploading User Credentials CnC Beacon |
rev 3 |
2014-12-11 |
| snort |
ET TROJAN Cloud Atlas CnC Beacon |
rev 1 |
2014-12-11 |
| snort |
ET MOBILE_MALWARE Android/Code4hk.A Checkin |
rev 2 |
2014-12-05 |
| snort |
ET TROJAN W32/DoubleTap.APT Downloader CnC Beacon |
rev 2 |
2014-12-05 |
| snort |
ET TROJAN W32/Hyteod.Downloader CnC Beacon |
rev 1 |
2014-12-01 |
| snort |
ET TROJAN Possible Regin Init CnC Beacon ICMP |
rev 1 |
2014-11-26 |
| snort |
ET TROJAN Possible Regin Init CnC Beacon UDP |
rev 1 |
2014-11-26 |
| snort |
ET TROJAN Possible Regin Init CnC Beacon TCP |
rev 2 |
2014-11-26 |
| snort |
ET MOBILE_MALWARE Android.Stealthgenie Checkin |
rev 1 |
2014-11-25 |
| snort |
ET TROJAN Rerdom/Asprox CnC Beacon |
rev 1 |
2014-11-20 |
| snort |
ET TROJAN OSX/WireLurker CnC Beacon |
rev 2 |
2014-11-12 |
| snort |
ET TROJAN Emotet CnC Beacon |
rev 1 |
2014-11-12 |
| snort |
ET TROJAN OSX/WireLurker CnC Beacon |
rev 2 |
2014-11-12 |
| snort |
ET TROJAN W32/Siggen.Dropper CnC Beacon |
rev 1 |
2014-10-27 |
| snort |
ET TROJAN W32/24x7Help.ScareWare CnC Beacon |
rev 2 |
2014-10-23 |
| snort |
ET MOBILE_MALWARE iOS/Xsser checking library version |
rev 1 |
2014-10-01 |
| snort |
ET MOBILE_MALWARE iOS/Xsser Checkin |
rev 1 |
2014-10-01 |
| snort |
ET TROJAN Zeus.Downloader Campaign Unknown Initial CnC Beacon |
rev 3 |
2014-09-19 |
| snort |
ET TROJAN W32/Bravix.Dropper CnC Beacon |
rev 1 |
2014-09-05 |
| snort |
ET MOBILE_MALWARE Worm.AndroidOS.Selfmite.a Checkin |
rev 1 |
2014-07-28 |
| snort |
ET TROJAN W32/Kbot.Backdoor Variant CnC Beacon |
rev 2 |
2014-07-25 |
| snort |
ET MOBILE_MALWARE Android Spyware Dowgin Checkin |
rev 1 |
2014-07-11 |
| snort |
ET TROJAN W32/Antifulai.APT CnC Beacon 1 |
rev 3 |
2014-07-03 |
| snort |
ET TROJAN Putter Panda 3PARA RAT initial beacon |
rev 2 |
2014-06-11 |
| snort |
ET TROJAN W32/Hicrazyk.A Downloader Install CnC Beacon |
rev 4 |
2014-05-17 |
| snort |
ET TROJAN W32/HelloBridge.Backdoor Login CnC Beacon |
rev 1 |
2014-05-14 |
| snort |
ET TROJAN W32/HelloBridge.Backdoor Register CnC Beacon |
rev 1 |
2014-05-14 |
| snort |
ET TROJAN W32/Asprox Passgrub POST CnC Beacon |
rev 2 |
2014-05-06 |
| snort |
ET TROJAN W32/Karagany.Downloader CnC Beacon |
rev 1 |
2014-05-05 |
| snort |
ET TROJAN W32/Eclipse.DDOSBot CnC Beacon Response |
rev 1 |
2014-04-28 |
| snort |
ET TROJAN W32/SpeedingUpMyPC.Rootkit Successful Install GET Type CnC Beacon |
rev 3 |
2014-04-14 |
| snort |
ET TROJAN W32/SpeedingUpMyPC.Rootkit Install CnC Beacon |
rev 1 |
2014-03-28 |
| snort |
ET TROJAN W32/SpeedingUpMyPC.Rootkit CnC Beacon |
rev 1 |
2014-03-28 |
| snort |
ET TROJAN W32/PointOfSales.Misc CnC Beacon |
rev 1 |
2014-03-11 |
| snort |
ET POLICY W32/Installiq.Adware Install Information Beacon |
rev 2 |
2014-03-06 |
| snort |
ET TROJAN W32/Qakbot.Bot Version 8 CnC Beacon |
rev 2 |
2014-03-04 |
| snort |
ET TROJAN W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon |
rev 1 |
2014-02-18 |
| snort |
ET MOBILE_MALWARE Android/FakeKakao checkin 3 |
rev 1 |
2014-02-14 |
| snort |
ET TROJAN W32/Asprox.ClickFraudBot POST CnC Beacon |
rev 2 |
2014-02-14 |
| snort |
ET MOBILE_MALWARE Android/FakeKakao checkin 1 |
rev 1 |
2014-02-14 |
| snort |
ET MOBILE_MALWARE Android/FakeKakao checkin 2 |
rev 1 |
2014-02-14 |
| snort |
ET TROJAN W32/Rshot.Backdoor File Upload CnC Beacon |
rev 1 |
2014-02-10 |
| snort |
ET TROJAN W32/Asprox.ClickFraudBot CnC Beacon |
rev 1 |
2014-02-10 |
| snort |
ET TROJAN W32/Asprox.ClickFraudBot CnC Beacon Acknowledgement |
rev 1 |
2014-02-10 |
| snort |
ET TROJAN W32/Neverquest.InfoStealer Configuration Request CnC Beacon |
rev 1 |
2014-01-31 |
| snort |
ET TROJAN W32/LockscreenBEI.Scareware Cnc Beacon |
rev 1 |
2014-01-28 |
| snort |
ET MOBILE_MALWARE Android/HeHe.Spy GetTaskRequest CnC Beacon |
rev 2 |
2014-01-22 |
| snort |
ET TROJAN W32/Liftoh.Downloader Feed404 CnC Beacon |
rev 1 |
2013-12-17 |
| snort |
ET TROJAN W32/Liftoh.Downloader Images CnC Beacon |
rev 1 |
2013-12-17 |
| snort |
ET TROJAN W32/Ke3chang.Dream.APT Campaign CnC Beacon 2 |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.MyWeb.APT Eourdegh Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.MovieStar.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.MyWeb.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Ke3chang.Snake.APT Campaign CnC Beacon |
rev 1 |
2013-12-13 |
| snort |
ET TROJAN W32/Citadel.Arx Varient CnC Beacon 2 |
rev 1 |
2013-11-07 |
| snort |
ET TROJAN W32/Citadel.Arx Variant CnC Beacon 1 |
rev 1 |
2013-11-07 |
| snort |
ET TROJAN W32/Downloader.Mevade.FBV CnC Beacon |
rev 1 |
2013-09-19 |
| snort |
ET MOBILE_MALWARE Android/FakeAhnAV.A CnC Beacon |
rev 1 |
2013-09-16 |
| snort |
ET WORM W32/Njw0rm CnC Beacon |
rev 3 |
2013-08-31 |
| snort |
ET TROJAN W32/Symmi Remote File Injector Initial CnC Beacon |
rev 1 |
2013-06-04 |
| snort |
ET TROJAN W32/Briba CnC POST Beacon |
rev 3 |
2013-05-22 |
| snort |
ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message |
rev 2 |
2013-03-23 |
| snort |
ET TROJAN [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message Header Local |
rev 2 |
2013-03-23 |
| snort |
ET TROJAN [CrowdStrike] ANCHOR PANDA - Adobe Gh0st Beacon |
rev 2 |
2013-03-23 |
| snort |
ET TROJAN W32/LetsGo.APT Sleep CnC Beacon |
rev 1 |
2013-03-14 |
| snort |
ET TROJAN W32/Trustezeb.C CnC Beacon |
rev 1 |
2013-03-08 |
| snort |
ET TROJAN W32/TrojanSpy.MSIL Get New MAC CnC Beacon |
rev 1 |
2013-03-05 |
| snort |
ET TROJAN W32/TrojanSpy.MSIL Fetch Time CnC Beacon |
rev 1 |
2013-03-05 |
| snort |
ET TROJAN W32/TrojanSpy.MSIL Set Done Day CnC Beacon |
rev 1 |
2013-03-05 |
| snort |
ET TROJAN W32/TrojanSpy.MSIL Fetch Header CnC Beacon |
rev 1 |
2013-03-05 |
| snort |
ET MOBILE_MALWARE Android/Smsilence.A Sending SMS Messages CnC Beacon |
rev 2 |
2013-03-01 |
| snort |
ET TROJAN WEBC2-KT3 Intial Connection Beacon APT1 Related |
rev 2 |
2013-02-22 |
| snort |
ET TROJAN WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related |
rev 3 |
2013-02-22 |
| snort |
ET TROJAN W32/FloatingCloud.Banker CnC Beacon |
rev 2 |
2013-02-09 |
| snort |
ET TROJAN W32/ServStart.Variant CnC Beacon |
rev 1 |
2013-02-05 |
| snort |
ET TROJAN W32/Beebus HTTP POST CnC Beacon |
rev 1 |
2013-02-05 |
| snort |
ET TROJAN W32/Jabberbot.A Trednet XMPP CnC Beacon |
rev 1 |
2013-02-01 |
| snort |
ET TROJAN W32/DownloaderAgent.fajk Successful Infection CnC Beacon |
rev 1 |
2013-01-30 |
| snort |
ET TROJAN Linux/SSHDoor.A Reporting Backdoor CnC Beacon |
rev 1 |
2013-01-30 |
| snort |
ET TROJAN W32/Bilakip.A Downloader API Ping CnC Beacon |
rev 1 |
2013-01-25 |
| snort |
ET TROJAN W32/Zemra.DDoS.Bot Variant CnC Beacon |
rev 1 |
2013-01-15 |
| snort |
ET TROJAN W32/Iyus.H Initial CnC Beacon |
rev 2 |
2013-01-15 |
| snort |
ET TROJAN W32/Downloader.FakeFlashPlayer Status.Php CnC Beacon |
rev 1 |
2012-12-29 |
| snort |
ET TROJAN W32.Daws/Sanny CnC Initial Beacon |
rev 2 |
2012-12-18 |
| snort |
ET TROJAN Win32/Trojan.Agent.AXMO CnC Beacon |
rev 1 |
2012-12-08 |
| snort |
ET MOBILE_MALWARE Android/Ozotshielder.A Checkin |
rev 1 |
2011-11-24 |
| snort |
ET MOBILE_MALWARE Android.HongTouTou Checkin |
rev 1 |
2011-06-21 |
| snort |
ET MOBILE_MALWARE Android Trojan MSO.PJApps checkin 2 |
rev 1 |
2011-03-10 |
| snort |
ET MOBILE_MALWARE Android Trojan MSO.PJApps checkin 1 |
rev 2 |
2011-03-10 |
| snort |
ET MOBILE_MALWARE Android Trojan Fake10086 checkin 2 |
rev 1 |
2011-03-10 |
| snort |
ET TROJAN Downloader.Win32.Small CnC Beacon |
rev 7 |
2011-02-08 |
| snort |
ET TROJAN Trojan.Win32.Cosmu.xet CnC Beacon |
rev 2 |
2010-09-29 |
| snort |
ET TROJAN FakeAV Win32/Antivirus2008 CnC Beacon |
rev 5 |
2010-09-26 |
| snort |
ET TROJAN Waledac Beacon Traffic Detected |
rev 3 |
2010-09-16 |
| sentinel |
IP address of Windows host encoded in web request |
Scheduled |
— |
| sentinel |
Windows host username encoded in base64 web request |
Scheduled |
— |
| sentinel |
RunningRAT request parameters |
Scheduled |
— |