Snort Rules

attempted-user

• "SERVER-ORACLE sys.dbms_repcat.alter_mview_propagation buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.comment_on_site_priority buffer overflow attempt"

• "FILE-IMAGE Microsoft Multiple Products JPEG parser heap overflow attempt"

• "PROTOCOL-SERVICES rlogin bin"

• "SERVER-ORACLE dbms_offline_og.end_load buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_master_repgroup buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_site_priority buffer overflow attempt"

• "SERVER-WEBAPP SWEditServlet directory traversal attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_aq_import_internal.aq_table_defn_update buffer overflow attempt"

• "OS-WINDOWS Microsoft Windows HTTP protocol stack remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.rename_shadow_column_group buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_grouped_column buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat_instantiate.instantiate_online buffer overflow attempt"

• "SERVER-WEBAPP Netgear DGN2200B stored cross-site scripting attempt"

• "SERVER-ORACLE dbms_repcat.switch_snapshot_master buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.register_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.purge_flavor_definition buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.create_snapshot_repgroup buffer overflow attempt"

• "MALWARE-CNC Win.Trojan.OilRig variant outbound connection"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SQL sp_adduser database user creation"

• "SERVER-ORACLE sys.dbms_repcat_sna.create_snapshot_repobject buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_priority_varchar2 buffer overflow attempt"

• "SERVER-ORACLE mdsys.md2.sdo_code_size buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.drop_object_from_flavor buffer overflow attempt"

• "SERVER-MSSQL raiserror possible buffer overflow"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_priority_nchar buffer overflow attempt"

• "SERVER-SAMBA Samba is_known_pipe arbitrary module load code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.relocate_masterdef buffer overflow attempt"

• "SERVER-ORACLE dbms_offline_og.begin_instantiation buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla_mas.drop_columns_from_flavor buffer overflow attempt"

• "MALWARE-CNC Cobalt Strike beacon inbound connection attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_unique_resolution buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_site_priority_site buffer overflow attempt"

• "FILE-OFFICE RTF document incorrect file magic attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_column_group buffer overflow attempt"

• "FILE-OTHER RARLAB WinRAR ZIP format filename spoof attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "FILE-MULTIMEDIA Nullsoft Winamp cda file name overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_master_propagation buffer overflow attempt"

• "SERVER-ORACLE TO_CHAR buffer overflow attempt"

• "SERVER-OTHER AIX pdnsd overflow"

• "SERVER-ORACLE dbms_repcat.drop_column_group_from_flavor buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat_sna_utl.register_flavor_change buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.drop_snapshot_repschema buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_priority_date buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_master_repobject buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_priority_nchar buffer overflow attempt"

• "FILE-IMAGE Microsoft PNG large colour depth download attempt"

• "SERVER-ORACLE dbms_repcat.add_priority_date buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_priority_nchar buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.generate_snapshot_support buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_column_group buffer overflow attempt"

• "SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt"

• "SERVER-WEBAPP FLIR Breakstream 2300 unauthenticated information disclosure attempt"

• "SERVER-OTHER squid WCCP I_SEE_YOU message overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_update_resolution buffer overflow attempt"

• "SERVER-ORACLE create file buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat_rgt.instantiate_online buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "FILE-OFFICE RTF document incorrect file magic attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_delete_resolution buffer overflow attempt"

• "MALWARE-CNC Cobalt Strike beacon outbound connection attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_update_resolution buffer overflow attempt"

• "SQL xp_cmdshell program execution 445"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority_varchar2 buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla_mas.obsolete_flavor_definition buffer overflow attempt"

• "BROWSER-FIREFOX Mozilla Firefox about field spoofing attempt"

• "SERVER-ORACLE dbms_offline_og.begin_flavor_change buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.rename_shadow_column_group buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_priority_date buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla_mas.add_column_group_to_flavor buffer overflow attempt"

• "SQL raiserror possible buffer overflow"

• "SERVER-ORACLE dbms_repcat.add_priority_raw buffer overflow attempt"

• "SERVER-ORACLE mdsys.md2.validate_geom buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.alter_snapshot_propagation buffer overflow attempt"

• "MALWARE-CNC Win.Trojan.OilRig variant outbound connection"

• "SQL sp_delete_alert log file deletion"

• "SERVER-ORACLE sys.dbms_repcat_sna.create_snapshot_repschema buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.publish_flavor_definition buffer overflow attempt"

• "SERVER-WEBAPP Netgear DGN2200B stored cross-site scripting attempt"

• "SQL xp_cmdshell program execution"

• "SERVER-ORACLE dbms_repcat.switch_mview_master buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.repcat_import_check buffer overflow attempt"

• "FILE-MULTIMEDIA RealNetworks RealPlayer playlist rtsp URL overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_mview_repobject buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.generate_replication_package buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.resume_master_activity buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_aqadm.verify_queue_types_get_nrp buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority_varchar2 buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.alter_snapshot_propagation buffer overflow attempt"

• "SERVER-WEBAPP Atlassian Confluence OGNL expression injection attempt"

• "SERVER-ORACLE dbms_offline_og.end_instantiation buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat_instantiate.drop_site_instantiation buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.comment_on_unique_resolution buffer overflow attempt"

• "SERVER-OTHER Arkeia backup client type 77 overflow attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_repsites buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority_char buffer overflow attempt"

• "SERVER-WEBAPP Kaspersky Linux File Server WMC cross site scripting attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_unique_resolution buffer overflow attempt"

• "BROWSER-IE Microsoft Internet Explorer malformed object type overflow attempt"

• "SERVER-ORACLE dbms_repcat.create_master_repobject buffer overflow attempt"

• "PROTOCOL-SERVICES rsh echo + +"

• "SERVER-ORACLE sys.dbms_repcat_mas.create_master_repgroup buffer overflow attempt"

• "SERVER-WEBAPP F5 BIG-IP iControl remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.validate_for_local_flavor buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.abort_flavor_definition buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority_nchar buffer overflow attempt"

• "SERVER-MAIL WinZip MIME content-disposition buffer overflow"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "PROTOCOL-FINGER remote command pipe execution attempt"

• "SERVER-ORACLE dbms_repcat.alter_priority_char buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.validate_for_local_flavor buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-MAIL Sendmail 5.6.5 exploit"

• "OS-LINUX Red Hat NetworkManager DHCP client command injection attempt"

• "SERVER-ORACLE dbms_repcat.define_site_priority buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.repcat_import_check buffer overflow attempt"

• "SQL sp_start_job - program execution"

• "SERVER-ORACLE dbms_repcat.drop_priority_number buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "BROWSER-FIREFOX Mozilla 1.0 Javascript arbitrary cookie access attempt"

• "FILE-IMAGE Microsoft and libpng multiple products PNG large image width overflow attempt"

• "SERVER-WEBAPP BA Systems BAS Web information disclosure attempt"

• "SERVER-ORACLE sys.dbms_internal_repcat.disable_receiver_trace buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_priority_char buffer overflow attempt"

• "SERVER-ORACLE LINK metadata buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_site_priority buffer overflow attempt"

• "OS-WINDOWS Microsoft Windows Content-Disposition CLSID command attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.comment_on_update_resolution buffer overflow attempt"

• "NETBIOS MikroTik RouterOS buffer overflow attempt"

• "SERVER-ORACLE user name buffer overflow attempt"

• "SERVER-ORACLE dbms_offline_snapshot.begin_load buffer overflow attempt"

• "SERVER-OTHER CHAT IRC topic overflow"

• "SERVER-ORACLE dbms_repcat.alter_priority_varchar2 buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority_nvarchar2 buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_aqadm.verify_queue_types_no_queue buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_priority_nvarchar2 buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.set_local_flavor buffer overflow attempt"

• "BROWSER-FIREFOX Mozilla 1.0 Javascript arbitrary cookie access attempt"

• "SERVER-ORACLE dbms_repcat.drop_snapshot_repgroup buffer overflow attempt"

• "SERVER-OTHER readme.eml download attempt"

• "SERVER-ORACLE dbms_repcat.create_snapshot_repobject buffer overflow attempt"

• "SERVER-MSSQL xp_reg* - registry access"

• "SERVER-MAIL Sendmail 8.6.9 exploit"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.set_local_flavor buffer overflow attempt"

• "SERVER-WEBAPP Progress webspeed access"

• "SERVER-ORACLE dbms_repcat.drop_priority_varchar2 buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.register_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.unregister_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.alter_snapshot_propagation buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_rq.add_column buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.unregister_snapshot_repgroup buffer overflow attempt"

• "SERVER-SAMBA Samba is_known_pipe arbitrary module load code execution attempt"

• "SERVER-ORACLE dbms_repcat.validate_flavor_definition buffer overflow attempt"

• "SERVER-ORACLE sys.ltutil.pushdeferredtxns buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.repcat_import_check buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.create_snapshot_repgroup buffer overflow attempt"

• "SERVER-MSSQL probe response overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_site_priority_site buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.register_mview_repgroup buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.create_mview_repobject buffer overflow attempt"

• "SQL xp_cmdshell - program execution"

• "SERVER-MAIL Sendmail 8.6.10 exploit"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.switch_snapshot_master buffer overflow attempt"

• "FILE-JAVA Oracle Javascript document.domain attempt"

• "SERVER-ORACLE dbms_repcat.drop_site_priority buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.specify_new_masters buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_aqadm_sys.verify_queue_types buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_priority_number buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority_raw buffer overflow attempt"

• "BROWSER-PLUGINS Symantec Norton Internet Security 2004 ActiveX clsid access"

• "SERVER-ORACLE dbms_repcat.comment_on_repobject buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_site_priority_site buffer overflow attempt"

• "SERVER-WEBAPP Atlassian Confluence OGNL expression injection attempt"

• "SERVER-ORACLE NUMTODSINTERVAL/NUMTOYMINTERVAL buffer overflow attempt"

• "SERVER-ORACLE dbms_offline_og.resume_subset_of_masters buffer overflow attempt"

• "OS-LINUX Red Hat NetworkManager DHCP client command injection attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.define_priority_group buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_unique_resolution buffer overflow attempt"

• "FILE-IMAGE Microsoft Multiple Products PNG large image height download attempt"

• "SERVER-ORACLE sys.dbms_internal_repcat.enable_receiver_trace buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_object_to_flavor buffer overflow attempt"

• "BROWSER-FIREFOX Mozilla Firefox ESR NotifyTimeChange use after free attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.drop_priority_nvarchar2 buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.do_deferred_repcat_admin buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.send_old_values buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_untrusted.register_snapshot_repgroup buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.alter_mview_propagation buffer overflow attempt"

• "BROWSER-IE Microsoft Internet Explorer bitmap BitmapOffset integer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "PROTOCOL-FINGER remote command execution attempt"

• "MALWARE-BACKDOOR MISC Solaris 2.5 attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority_date buffer overflow attempt"

• "SERVER-ORACLE dbms_rectifier_diff.rectify buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.alter_master_repobject buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.create_master_repobject buffer overflow attempt"

• "OS-WINDOWS Microsoft Windows HTML Help hhctrl.ocx clsid access attempt"

• "SERVER-ORACLE dbms_repcat.create_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority_date buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_site_priority_site buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_columns_to_flavor buffer overflow attempt"

• "PUA-OTHER Microsoft MSN Messenger png overflow"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_rectifier_diff.rectify buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.relocate_masterdef buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_priority_raw buffer overflow attempt"

• "SERVER-MAIL Sendmail 8.6.9c exploit"

• "SERVER-ORACLE sys.dbms_repcat_utl.drop_an_object buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.define_column_group buffer overflow attempt"

• "SERVER-MAIL Sendmail 8.6.10 exploit"

• "SERVER-ORACLE dbms_repcat.alter_priority_nchar buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.suspend_master_activity buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.cancel_statistics buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority_nvarchar2 buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.set_local_flavor buffer overflow attempt"

• "FILE-OTHER local resource redirection attempt"

• "SERVER-WEBAPP Atlassian Confluence OGNL expression injection attempt"

• "SERVER-WEBAPP Linksys E-Series apply.cgi cross site scripting attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.do_deferred_repcat_admin buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_priority_varchar2 buffer overflow attempt"

• "PROTOCOL-DNS glibc getaddrinfo AAAA record stack buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.validate_for_local_flavor buffer overflow attempt"

• "FILE-OFFICE RFT document malformed header"

• "BROWSER-IE Microsoft Internet Explorer ANI file parsing buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_internal_repcat.validate buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.purge_statistics buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.register_snapshot_repgroup buffer overflow attempt"

• "FILE-OTHER readme.eml autoload attempt"

• "SERVER-ORACLE dbms_repcat.refresh_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.unregister_snapshot_repgroup buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SQL sp_delete_alert log file deletion"

• "SERVER-ORACLE dbms_repcat.generate_replication_trigger buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat_admin.register_user_repgroup buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_unique_resolution buffer overflow attempt"

• "OS-WINDOWS Microsoft Windows Media Player directory traversal via Content-Disposition attempt"

• "SERVER-ORACLE dbms_repcat.send_and_compare_old_values buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "BROWSER-OTHER Netscape 4.7 client overflow"

• "SERVER-WEBAPP Atlassian Confluence remote code execution attempt"

• "SERVER-ORACLE sys.dbms_defer_internal_sys.parallel_push_recovery buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority_nchar buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_priority_raw buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.compare_old_values buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.comment_on_repgroup buffer overflow attempt"

• "SERVER-ORACLE dbms_rectifier_diff.differences buffer overflow attempt"

• "SERVER-ORACLE dbms_offline_og.begin_load buffer overflow attempt"

• "SERVER-ORACLE from_tz buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority_char buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.define_site_priority buffer overflow attempt"

• "OS-WINDOWS Microsoft Windows Content-Disposition CLSID command attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_update_resolution buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.create_master_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_auth.revoke_surrogate_repcat buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_update_resolution buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_delete_resolution buffer overflow attempt"

• "OS-WINDOWS Microsoft Windows Content-Disposition CLSID command attempt"

• "SERVER-ORACLE dbms_repcat_instantiate.instantiate_offline buffer overflow attempt"

• "PROTOCOL-SERVICES rsh bin"

• "SERVER-ORACLE dbms_offline_snapshot.end_load buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.comment_on_repobject buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_priority buffer overflow attempt"

• "SERVER-WEBAPP Simple Web Counter URI Parameter Buffer Overflow attempt"

• "SERVER-MAIL WinZip MIME content-type buffer overflow"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_priority_number buffer overflow attempt"

• "SERVER-WEBAPP Atlassian Confluence remote code execution attempt"

• "SERVER-ORACLE sys.dbms_defer_repcat.enable_propagation_to_dblink buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.set_columns buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_snapshot_repobject buffer overflow attempt"

• "PROTOCOL-IMAP login buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.switch_snapshot_master buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SQL sp_adduser - database user creation"

• "SERVER-ORACLE dbms_repcat.generate_mview_support buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.refresh_mview_repgroup buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "FILE-IMAGE Microsoft Multiple Products JPEG parser heap overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.register_statistics buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.refresh_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_rectifier_diff.differences buffer overflow attempt"

• "PROTOCOL-DNS glibc getaddrinfo A record stack buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.abort_flavor_definition buffer overflow attempt"

• "FILE-OFFICE RFT document malformed header"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_priority_raw buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.drop_master_repgroup buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-WEBAPP Linksys E-Series apply.cgi cross site scripting attempt"

• "SERVER-ORACLE Oracle 9i TNS Listener SERVICE_NAME Remote Buffer Overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.validate_flavor_definition buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.generate_replication_support buffer overflow attempt"

• "SERVER-OTHER NextFTP client overflow"

• "SERVER-ORACLE dbms_repcat.add_grouped_column buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority_number buffer overflow attempt"

• "MALWARE-CNC Win.Trojan.OilRig variant outbound connection"

• "SERVER-ORACLE sysdbms_repcat_rgt.check_ddl_text buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.unregister_mview_repgroup buffer overflow attempt"

• "FILE-IMAGE libpng tRNS overflow attempt"

• "EXPLOIT-KIT Blackhole exploit kit landing page with specific structure - prototype catch"

• "SERVER-ORACLE dbms_repcat.alter_priority_date buffer overflow attempt"

• "EXPLOIT-KIT Blackhole exploit kit landing page with specific structure - prototype catch"

• "SERVER-MSSQL xp_reg* registry access"

• "SERVER-ORACLE dbms_repcat_admin.unregister_user_repgroup buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.define_priority_group buffer overflow attempt"

• "SERVER-MAIL Sendmail 8.6.9 exploit"

• "SERVER-ORACLE sys.dbms_repcat_utl4.drop_master_repobject buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.register_statistics buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_priority buffer overflow attempt"

• "X11 MIT Magic Cookie detected"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-OTHER Adobe Coldfusion expeval access"

• "SERVER-ORACLE dbms_repcat.add_column_group_to_flavor buffer overflow attempt"

• "SERVER-WEBAPP BA Systems BAS Web information disclosure attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.add_object_to_flavor buffer overflow attempt"

• "FILE-IMAGE Microsoft and libpng multiple products PNG large image width overflow attempt"

• "SERVER-ORACLE mdsys.sdo_admin.sdo_code_size buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.drop_snapshot_repgroup buffer overflow attempt"

• "INDICATOR-SHELLCODE shellcode attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.drop_snapshot_repobject buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.purge_statistics buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_mview_repgroup buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.refresh_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.remove_master_databases buffer overflow attempt"

• "SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt"

• "SERVER-ORACLE dbms_repcat.execute_ddl buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat_rgt.check_ddl_text buffer overflow attempt"

• "SERVER-ORACLE ctx_output.start_log buffer overflow attempt"

• "SERVER-ORACLE alter file buffer overflow attempt"

• "PROTOCOL-OTHER TP-Link TDDP SET_CONFIG type buffer overflow attempt"

• "SERVER-MSSQL xp_sprintf possible buffer overflow"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.cancel_statistics buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_site_priority_site buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat_auth.revoke_surrogate_repcat buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.create_mview_repgroup buffer overflow attempt"

• "FILE-OFFICE Microsoft Office RTF WRAssembly ASLR bypass download attempt"

• "FILE-MULTIMEDIA RealNetworks RealPlayer playlist file URL overflow attempt"

• "SERVER-ORACLE dbms_offline_og.end_flavor_change buffer overflow attempt"

• "SERVER-OTHER Adobe Coldfusion CFUSION_VERIFYMAIL access"

• "SERVER-ORACLE sys.dbms_repcat_mas.resume_master_activity buffer overflow attempt"

• "SERVER-OTHER eMule buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.comment_on_delete_resolution buffer overflow attempt"

• "SERVER-WEBAPP PHPLIB remote command attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_mview_repsites buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_auth.grant_surrogate_repcat buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_priority_nvarchar2 buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla_mas.add_columns_to_flavor buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_object_from_flavor buffer overflow attempt"

• "SQL sp_password password change"

• "SERVER-ORACLE dbms_repcat.obsolete_flavor_definition buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_columns_from_flavor buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_priority_char buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_delete_resolution buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_unique_resolution buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority buffer overflow attempt"

• "MALWARE-CNC Cobalt Strike beacon outbound connection attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla_mas.publish_flavor_definition buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.generate_replication_package buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.alter_master_repobject buffer overflow attempt"

• "SERVER-OTHER Arkeia backup client type 84 overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_priority_nvarchar2 buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_priority_number buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.purge_master_log buffer overflow attempt"

• "OS-WINDOWS Microsoft Windows Content-Disposition CLSID command attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla_mas.purge_flavor_definition buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_priority_raw buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE dbms_repcat_rgt.instantiate_offline buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_site_priority_site buffer overflow attempt"

• "SERVER-WEBAPP Atlassian Confluence OGNL expression injection attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.add_delete_resolution buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.make_column_group buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_delete_resolution buffer overflow attempt"

• "SQL sp_start_job - program execution"

• "SERVER-ORACLE dbms_repcat.drop_priority_char buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla_mas.drop_column_group_from_flavor buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.add_priority_number buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.comment_on_priority_group buffer overflow attempt"

• "SERVER-OTHER Bontago Game Server Nickname buffer overflow"

• "SERVER-ORACLE time_zone buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.comment_on_priority_group buffer overflow attempt"

• "SERVER-WEBAPP PHPLIB remote command attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.ensure_not_published buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_mas.suspend_master_activity buffer overflow attempt"

• "FILE-MULTIMEDIA RealNetworks RealPlayer playlist http URL overflow attempt"

• "SERVER-ORACLE dbms_repcat.begin_flavor_definition buffer overflow attempt"

• "FILE-OFFICE Microsoft Office RTF WRAssembly ASLR bypass download attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.alter_site_priority buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_conf.drop_site_priority buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_system.ksdwrt buffer overflow attempt"

• "BROWSER-FIREFOX Mozilla Firefox ESR NotifyTimeChange use after free attempt"

• "SERVER-ORACLE sys.dbms_repcat_utl.is_master buffer overflow attempt"

• "FILE-OTHER Nullsoft Winamp XM file buffer overflow attempt"

• "SERVER-OTHER Apache Log4j logging remote code execution attempt"

• "FILE-OTHER RARLAB WinRAR ZIP format filename spoof attempt"

• "SERVER-ORACLE dbms_repcat_rgt.drop_site_instantiation buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.drop_update_resolution buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.refresh_snapshot_repschema buffer overflow attempt"

• "SERVER-ORACLE dbms_repcat.generate_snapshot_support buffer overflow attempt"

• "SQL sp_password - password change"

• "SERVER-ORACLE dbms_repcat.purge_master_log buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_sna.drop_snapshot_repobject buffer overflow attempt"

• "SERVER-MSSQL xp_sprintf possible buffer overflow"

• "SERVER-ORACLE sys.dbms_repcat_sna_utl.drop_snapshot_repgroup buffer overflow attempt"

• "SERVER-ORACLE ctxsys.driddlr.subindexpopulate buffer overflow attempt"

• "SERVER-ORACLE sys.dbms_repcat_fla.begin_flavor_definition buffer overflow attempt"

attempted-admin

• "PROTOCOL-POP XTND overflow attempt"

• "SERVER-OTHER WSFTP IpSwitch custom SITE command execution attempt"

• "SERVER-WEBAPP Linksys E1500/E2500 apply.cgi submit_button page redirection attempt"

• "SERVER-MAIL Sendmail 8.6.9 exploit"

• "SERVER-OTHER NETGEAR TelnetEnable attempt"

• "OS-WINDOWS DCERPC NCACN-IP-TCP llsrpc LlsrConnect overflow attempt"

• "SERVER-WEBAPP Netgear DGN1000 series routers arbitrary command execution attempt"

• "OS-LINUX x86 Linux mountd overflow"

• "SERVER-WEBAPP SSLv2 Client_Hello Challenge Length overflow attempt"

• "PROTOCOL-FTP STOR overflow attempt"

• "SERVER-OTHER LPRng overflow"

• "OS-OTHER Bash environment variable injection attempt"

• "PROTOCOL-NNTP AUTHINFO USER overflow attempt"

• "MALWARE-BACKDOOR MISC Linux rootkit attempt"

• "SERVER-OTHER Veritas backup overflow attempt"

• "SERVER-OTHER ISAKMP fifth payload certificate request length overflow attempt"

• "SERVER-OTHER Oracle Web Cache PUT overflow attempt"

• "PROTOCOL-POP EXPLOIT x86 BSD overflow"

• "PROTOCOL-FTP invalid MDTM command attempt"

• "OS-WINDOWS name query overflow attempt UDP"

• "SERVER-WEBAPP PHP-CGI remote file include attempt"

• "OS-LINUX Linux Kernel Challenge ACK provocation attempt"

• "PROTOCOL-RPC STATD TCP stat mon_name format string exploit attempt"

• "PUA-OTHER PCAnywhere Attempted Administrator Login"

• "SERVER-OTHER ISAKMP forth payload certificate request length overflow attempt"

• "SERVER-OTHER AFP FPLoginExt username buffer overflow attempt"

• "SERVER-MSSQL version overflow attempt"

• "MALWARE-BACKDOOR w00w00 attempt"

• "PROTOCOL-FTP DELE overflow attempt"

• "OS-OTHER Bash environment variable injection attempt"

• "OS-OTHER Bash environment variable injection attempt"

• "SERVER-WEBAPP MikroTik RouterOS jsproxy readPostData memory corruption attempt"

• "OS-LINUX x86 Linux overflow attempt"

• "OS-WINDOWS DCERPC NCACN-IP-TCP lsass DsRolerUpgradeDownlevelServer overflow attempt"

• "SERVER-OTHER libupnp command buffer overflow attempt"

• "SERVER-MAIL Sendmail rcpt to command attempt"

• "SERVER-MAIL Sendmail MAIL FROM prescan too many addresses overflow"

• "OS-OTHER Malicious DHCP server bash environment variable injection attempt"

• "PROTOCOL-FTP CEL overflow attempt"

• "SERVER-OTHER QNAP remote buffer overflow attempt"

• "PROTOCOL-FTP NLST overflow attempt"

• "PROTOCOL-FTP USER overflow attempt"

• "PROTOCOL-FTP Multiple Products FTP MKD buffer overflow attempt"

• "PROTOCOL-FTP CWD overflow attempt"

• "SERVER-MAIL Content-Type overflow attempt"

• "SERVER-MAIL Sendmail RCPT TO prescan too long addresses overflow"

• "SERVER-MAIL Sendmail 5.5.5 exploit"

• "PROTOCOL-FINGER cmd_rootsh backdoor attempt"

• "OS-OTHER Bash environment variable injection attempt"

• "OS-LINUX x86 Linux overflow attempt ADMv2"

• "PROTOCOL-POP USER overflow attempt"

• "SERVER-OTHER ebola PASS overflow attempt"

• "SERVER-WEBAPP Netgear WNR2000 hidden_lang_avi stack buffer overflow attempt"

• "OS-OTHER Bash environment variable injection attempt"

• "PROTOCOL-FTP REST overflow attempt"

• "PROTOCOL-FTP SITE CHOWN overflow attempt"

• "SERVER-OTHER QNAP QTS cross site request forgery attempt"

• "NETBIOS NS lookup short response attempt"

• "PROTOCOL-POP EXPLOIT qpopper overflow"

• "PROTOCOL-SERVICES rexec password overflow attempt"

• "SERVER-OTHER ISAKMP third payload certificate request length overflow attempt"

• "PROTOCOL-FTP RMDIR overflow attempt"

• "PROTOCOL-RPC STATD UDP monitor mon_name format string exploit attempt"

• "SERVER-OTHER Oracle Web Cache HEAD overflow attempt"

• "PROTOCOL-POP EXPLOIT x86 BSD overflow"

• "SERVER-WEBAPP Checkpoint Firewall-1 HTTP parsing format string vulnerability attempt"

• "MALWARE-BACKDOOR MISC rewt attempt"

• "SERVER-OTHER MDBMS overflow"

• "SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt"

• "PROTOCOL-POP USER format string attempt"

• "PROTOCOL-DNS UDP inverse query overflow"

• "OS-SOLARIS Oracle Solaris npls x86 overflow"

• "SERVER-WEBAPP SSLv2 Client_Hello with pad Challenge Length overflow attempt"

• "OS-LINUX x86 Linux mountd overflow"

• "SERVER-MAIL RCPT TO overflow"

• "PROTOCOL-TELNET SGI telnetd format bug"

• "SERVER-WEBAPP Linksys E1500/E2500 apply.cgi submit_button page redirection attempt"

• "PROTOCOL-NNTP version overflow attempt"

• "SERVER-OTHER Bind Buffer Overflow via NXT records"

• "NETBIOS NS lookup response name overflow attempt"

• "PROTOCOL-RPC tooltalk TCP overflow attempt"

• "PROTOCOL-NNTP newgroup overflow attempt"

• "PROTOCOL-FTP MKD overflow attempt"

• "PROTOCOL-POP TOP overflow attempt"

• "SERVER-OTHER Oracle Web Cache COPY overflow attempt"

• "OS-LINUX x86 Linux overflow attempt"

• "SERVER-MAIL HELO overflow attempt"

• "OS-OTHER Bash environment variable injection attempt"

• "PROTOCOL-RPC CMSD TCP CMSD_CREATE buffer overflow attempt"

• "PROTOCOL-FTP CMD overflow attempt"

• "SERVER-MAIL Sendmail SEND FROM prescan too many addresses overflow"

• "PROTOCOL-FTP XMKD overflow attempt"

• "PROTOCOL-POP PASS format string attempt"

• "PROTOCOL-FTP RNFR overflow attempt"

• "SERVER-WEBAPP server negative Content-Length attempt"

• "PROTOCOL-SERVICES Unix rlogin froot parameter root access attempt"

• "PROTOCOL-RPC CMSD TCP CMSD_CREATE array buffer overflow attempt"

• "SERVER-WEBAPP Netgear WNDR4700 and R6200 admin interface authentication bypass attempt"

• "OS-WINDOWS DCERPC Messenger Service buffer overflow attempt"

• "PROTOCOL-DNS TCP inverse query overflow"

• "MALWARE-BACKDOOR MISC Linux rootkit attempt"

• "SERVER-WEBAPP Magento remote code execution attempt"

• "SERVER-OTHER Oracle Web Cache TRACE overflow attempt"

• "PROTOCOL-FTP STAT overflow attempt"

• "OS-OTHER Bash CGI environment variable injection attempt"

• "PROTOCOL-RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"

• "SERVER-WEBAPP vBulletin upgrade.php exploit attempt"

• "PROTOCOL-FTP STOU overflow attempt"

• "PROTOCOL-SERVICES rexec username overflow attempt"

• "PROTOCOL-POP RSET overflow attempt"

• "PROTOCOL-FTP APPE overflow attempt"

• "PROTOCOL-RPC STATD UDP stat mon_name format string exploit attempt"

• "OS-WINDOWS Microsoft Windows RDP MS_T120 channel bind attempt"

• "OS-OTHER Bash CGI environment variable injection attempt"

• "SERVER-OTHER Oracle Web Cache POST overflow attempt"

• "OS-WINDOWS Microsoft Windows WINS name query overflow attempt UDP"

• "MALWARE-BACKDOOR MISC Linux rootkit attempt lrkr0x"

• "SERVER-OTHER QNAP NVR/NAS Heap/Stack Overflow attempt"

• "SERVER-OTHER VQServer admin"

• "SERVER-WEBAPP HNAP remote code execution attempt"

• "PROTOCOL-FTP XCWD overflow attempt"

• "SERVER-MAIL x86 windows MailMax overflow"

• "PROTOCOL-RPC CMSD UDP CMSD_CREATE array buffer overflow attempt"

• "PROTOCOL-FTP SITE overflow attempt"

• "PROTOCOL-IMAP UNSUBSCRIBE overflow attempt"

• "SERVER-MAIL VRFY overflow attempt"

• "SERVER-OTHER Xtramail Username overflow attempt"

• "SERVER-MAIL Sendmail RCPT TO decode attempt"

• "PROTOCOL-POP CAPA overflow attempt"

• "SERVER-OTHER Oracle Web Cache MKCOL overflow attempt"

• "SERVER-OTHER esignal STREAMQUOTE buffer overflow attempt"

• "PROTOCOL-FTP PASS overflow attempt"

• "PROTOCOL-NNTP rmgroup overflow attempt"

• "PROTOCOL-FTP RETR format string attempt"

• "PROTOCOL-RPC tooltalk UDP overflow attempt"

• "PROTOCOL-SERVICES rsh froot"

• "PROTOCOL-NNTP checkgroups overflow attempt"

• "SERVER-OTHER Bind Buffer Overflow via NXT records named overflow ADM"

• "SERVER-WEBAPP McAfee ePO file upload attempt"

• "PROTOCOL-IMAP login format string attempt"

• "SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt"

• "SERVER-MAIL Sendmail SAML FROM prescan too many addresses overflow"

• "SERVER-WEBAPP Multiple products OGNL expression injection attempt"

• "OS-WINDOWS DCERPC NCADG-IP-UDP msqueue function 4 overflow attempt"

• "OS-OTHER Bash CGI environment variable injection attempt"

• "PROTOCOL-FTP ALLO overflow attempt"

• "PROTOCOL-POP APOP overflow attempt"

• "SERVER-OTHER Bind Buffer Overflow via NXT records named overflow ADMROCKS"

• "SERVER-MAIL EXPN overflow attempt"

• "OS-WINDOWS DCERPC NCACN-IP-TCP nddeapi NDdeSetTrustedShareW overflow attempt"

• "PROTOCOL-TELNET login buffer non-evasive overflow attempt "

• "SERVER-MAIL sniffit overflow"

• "PROTOCOL-NNTP article post without path attempt"

• "SERVER-WEBAPP Linksys E-series HNAP TheMoon remote code execution attempt"

• "OS-WINDOWS DCERPC NCACN-IP-TCP IActivation remoteactivation overflow attempt"

• "OS-WINDOWS Messenger message overflow attempt"

• "PROTOCOL-NNTP sendsys overflow attempt"

• "SERVER-WEBAPP DotNetNuke installation attempt detected"

• "SERVER-OTHER QNAP NVR/NAS Heap/Stack Overflow attempt"

• "PROTOCOL-POP DELE overflow attempt"

• "PROTOCOL-FTP RETR overflow attempt"

• "MALWARE-BACKDOOR trinity connection attempt"

• "SERVER-OTHER Cisco IOS Smart Install protocol version command attempt"

• "SERVER-OTHER Oracle Web Cache LOCK overflow attempt"

• "SERVER-WEBAPP admin.php file upload attempt"

• "MALWARE-BACKDOOR MISC sm4ck attempt"

• "SERVER-OTHER delegate proxy overflow"

• "PROTOCOL-SERVICES rsh root"

• "OS-OTHER Bash CGI environment variable injection attempt"

• "OS-LINUX ntalkd x86 Linux overflow"

• "PROTOCOL-NNTP ihave overflow attempt"

• "PROTOCOL-SERVICES rlogin root"

• "OS-WINDOWS DCERPC NCADG-IP-UDP irot IrotIsRunning/Revoke overflow attempt"

• "PROTOCOL-TELNET resolv_host_conf"

• "SERVER-OTHER esignal SNAPQUOTE buffer overflow attempt"

• "PROTOCOL-TELNET login buffer overflow attempt"

• "PROTOCOL-TELNET Attempted SU from wrong group"

• "PROTOCOL-TELNET bsd telnet exploit response"

• "PROTOCOL-NNTP sendme overflow attempt"

• "OS-WINDOWS DCERPC NCACN-IP-TCP irot IrotIsRunning/Revoke overflow attempt"

• "SERVER-OTHER SCO calserver overflow"

• "SERVER-IIS SQLXML content type overflow"

• "MALWARE-BACKDOOR MISC Linux rootkit satori attempt"

• "SERVER-OTHER Oracle Web Cache DELETE overflow attempt"

• "PROTOCOL-RPC CMSD UDP CMSD_CREATE buffer overflow attempt"

• "OS-OTHER Bash CGI environment variable injection attempt"

• "SERVER-OTHER Cisco IOS Smart Install protocol download image command attempt"

• "PROTOCOL-RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"

• "SERVER-OTHER QNAP transcode server command injection attempt"

• "PROTOCOL-NNTP Microsoft Windows SEARCH pattern overflow attempt"

• "SERVER-MAIL ETRN overflow attempt"

• "PROTOCOL-POP STAT overflow attempt"

• "SERVER-OTHER Oracle Web Cache MOVE overflow attempt"

• "OS-WINDOWS Messenger message little endian overflow attempt"

• "PROTOCOL-NNTP senduuname overflow attempt"

• "SERVER-WEBAPP Linksys E-series HNAP TheMoon remote code execution attempt"

• "OS-WINDOWS Microsoft Windows PPTP Start Control Request buffer overflow attempt"

• "SERVER-OTHER Ethereal EIGRP prefix length overflow attempt"

• "OS-WINDOWS Microsoft Windows SMB-DS DCERPC Messenger Service buffer overflow attempt"

• "SERVER-OTHER Bind named overflow attempt"

• "PROTOCOL-FTP RNTO overflow attempt"

• "PROTOCOL-POP PASS overflow attempt"

• "PROTOCOL-POP APOP USER overflow attempt"

• "OS-WINDOWS DCERPC NCACN-IP-TCP winreg OpenKey overflow attempt"

• "PROTOCOL-IMAP SUBSCRIBE overflow attempt"

• "PROTOCOL-IMAP login literal format string attempt"

• "PROTOCOL-TFTP GET filename overflow attempt"

• "SERVER-OTHER libupnp command buffer overflow attempt"

• "POLICY-OTHER Teleopti WFM administrative user creation detected"

• "SERVER-MAIL Sendmail RCPT TO prescan too many addresses overflow"

• "PROTOCOL-RPC STATD TCP monitor mon_name format string exploit attempt"

• "MALWARE-BACKDOOR win-trin00 connection attempt"

• "SERVER-OTHER Cisco IOS Smart Install protocol download config command attempt"

• "POLICY-OTHER PPTP Start Control Request attempt"

• "SERVER-OTHER Oracle Web Cache GET overflow attempt"

• "MALWARE-BACKDOOR MISC r00t attempt"

• "OS-WINDOWS Microsoft Malware Protection Engine type confusion attempt"

• "SERVER-MAIL XEXCH50 overflow attempt"

• "SERVER-MAIL From comment overflow attempt"

• "SERVER-OTHER Bind Buffer Overflow named tsig overflow attempt"

• "OS-LINUX x86 Linux mountd overflow"

• "SERVER-IIS WEBDAV nessus safe scan attempt"

• "FILE-IMAGE JPEG parser multipacket heap overflow attempt"

• "PROTOCOL-TELNET ld_library_path"

• "SERVER-MAIL Netmanager chameleon SMTPd buffer overflow attempt"

• "SERVER-MAIL Sendmail Content-Transfer-Encoding overflow attempt"

• "PROTOCOL-IMAP SUBSCRIBE literal overflow attempt"

• "SERVER-OTHER ISAKMP second payload certificate request length overflow attempt"

• "SERVER-MAIL Sendmail SOML FROM prescan too many addresses overflow"

• "SERVER-MAIL Microsoft Exchange Server arbitrary file write attempt"

• "SERVER-OTHER ebola USER overflow attempt"

• "BROWSER-IE Microsoft Internet Explorer Content-Encoding overflow attempt"

• "SERVER-MAIL Majordomo ifs"

• "SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt"

• "OS-OTHER x86 FreeBSD overflow attempt"

• "SERVER-WEBAPP Asus RT-AC88U deleteOfflineClients memory corruption attempt"

• "PROTOCOL-POP EXPLOIT x86 SCO overflow"

• "PROTOCOL-FTP SITE NEWER overflow attempt"

• "OS-OTHER Bash environment variable injection attempt"

• "SERVER-WEBAPP Netgear WNR2000 authentication bypass attempt"

• "SERVER-OTHER Ethereal IGMP IGAP message overflow attempt"

• "SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt"

• "SERVER-WEBAPP Linksys E1500/E2500 apply.cgi unauthenticated password reset attempt"

• "PROTOCOL-POP AUTH overflow attempt"

• "SERVER-WEBAPP Drupal 8 remote code execution attempt"

• "SERVER-OTHER NETGEAR TelnetEnable attempt"

• "OS-WINDOWS Microsoft Windows XPAT pattern overflow attempt"

• "SERVER-WEBAPP Linksys E1500/E2500 apply.cgi unauthenticated password reset attempt"

• "PROTOCOL-POP LIST overflow attempt"

• "SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt"

• "PROTOCOL-FTP RMD overflow attempt"

• "SERVER-OTHER Ethereal IGMP IGAP account overflow attempt"

• "SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt"

• "OS-WINDOWS Microsoft Windows SMB remote code execution attempt"

• "PROTOCOL-FTP SITE ZIPCHK overflow attempt"

• "OS-SOLARIS EXPLOIT sparc overflow attempt"

• "PROTOCOL-POP EXPLOIT x86 Linux overflow"

• "OS-WINDOWS Microsoft Windows SMB remote code execution attempt"

• "OS-WINDOWS Microsoft Windows WINS name query overflow attempt TCP"

• "PROTOCOL-TFTP PUT filename overflow attempt"

• "SERVER-MAIL Microsoft Exchange Server arbitrary file write attempt"

• "SERVER-OTHER ISAKMP first payload certificate request length overflow attempt"

• "SERVER-WEBAPP DD-WRT httpd cgi-bin remote command execution attempt"

• "SERVER-IIS WEBDAV exploit attempt"

• "SERVER-OTHER Bind Buffer Overflow named tsig overflow attempt"

• "PROTOCOL-FTP SITE CHMOD overflow attempt"

• "SERVER-OTHER HP Web JetAdmin ExecuteFile admin access"

• "OS-LINUX Redhat 7.0 lprd overflow"

• "OS-WINDOWS Microsoft Malware Protection Engine type confusion attempt"

• "PROTOCOL-RPC snmpXdmi overflow attempt TCP"

• "OS-WINDOWS Microsoft Windows SMB-DS DCERPC Remote Activation bind attempt"

• "OS-WINDOWS Microsoft Windows Server 2003 smart card authentication buffer overflow attempt"

• "MALWARE-BACKDOOR attempt"

• "SERVER-IIS w3who.dll buffer overflow attempt"

• "PROTOCOL-RPC snmpXdmi overflow attempt UDP"

• "OS-WINDOWS name query overflow attempt TCP"

• "SERVER-OTHER Cisco IOS Smart Install protocol backup config command attempt"

• "SERVER-MAIL Sendmail MAIL FROM prescan too long addresses overflow"

• "OS-WINDOWS DCERPC NCADG-IP-UDP lsass DsRolerUpgradeDownlevelServer overflow attempt"

• "OS-LINUX x86 Linux samba overflow"

• "PROTOCOL-FTP MDTM overflow attempt"

rpc-portmap-decode

• "PROTOCOL-RPC portmap snmpXdmi request TCP"

• "PROTOCOL-RPC portmap proxy integer overflow attempt TCP"

• "PROTOCOL-RPC Solaris UDP portmap sadmin port query request attempt"

• "PROTOCOL-RPC AMD TCP version request"

• "PROTOCOL-RPC yppasswd old password overflow attempt UDP"

• "PROTOCOL-RPC yppasswd user update UDP"

• "PROTOCOL-RPC portmap proxy attempt TCP"

• "PROTOCOL-RPC portmap yppasswd request UDP"

• "PROTOCOL-RPC portmap NFS request UDP"

• "PROTOCOL-RPC portmap ypupdated request UDP"

• "PROTOCOL-RPC portmap ypserv request TCP"

• "PROTOCOL-RPC portmap ttdbserv request UDP"

• "PROTOCOL-RPC portmap proxy attempt UDP"

• "PROTOCOL-RPC yppasswd new password overflow attempt TCP"

• "PROTOCOL-RPC portmap RQUOTA request TCP"

• "PROTOCOL-RPC yppasswd username overflow attempt TCP"

• "PROTOCOL-RPC portmap kcms_server request TCP"

• "PROTOCOL-RPC AMD UDP pid request"

• "PROTOCOL-RPC portmap rusers request UDP"

• "PROTOCOL-RPC rpc.xfsmd xfs_export attempt TCP"

• "PROTOCOL-RPC portmap proxy integer overflow attempt UDP"

• "PROTOCOL-RPC portmap listing TCP 32771"

• "PROTOCOL-RPC portmap amountd request UDP"

• "PROTOCOL-RPC network-status-monitor mon-callback request UDP"

• "PROTOCOL-RPC portmap nisd request TCP"

• "PROTOCOL-RPC portmap rusers request TCP"

• "PROTOCOL-RPC portmap rwalld request TCP"

• "PROTOCOL-RPC portmap SET attempt TCP 111"

• "PROTOCOL-RPC portmap espd request TCP"

• "PROTOCOL-RPC rpc.xfsmd xfs_export attempt UDP"

• "PROTOCOL-RPC portmap rstatd request UDP"

• "PROTOCOL-RPC AMD TCP pid request"

• "PROTOCOL-RPC portmap espd request UDP"

• "PROTOCOL-RPC portmap status request TCP"

• "PROTOCOL-RPC portmap rexd request UDP"

• "PROTOCOL-RPC portmap rpc.xfsmd request TCP"

• "PROTOCOL-RPC portmap rwalld request UDP"

• "PROTOCOL-RPC portmap rstatd request TCP"

• "PROTOCOL-RPC portmap network-status-monitor request TCP"

• "PROTOCOL-RPC portmap listing TCP 111"

• "PROTOCOL-RPC portmap bootparam request UDP"

• "PROTOCOL-RPC portmap selection_svc request TCP"

• "PROTOCOL-RPC portmap cmsd request TCP"

• "PROTOCOL-RPC portmap network-status-monitor request UDP"

• "PROTOCOL-RPC portmap rexd request TCP"

• "PROTOCOL-RPC portmap UNSET attempt UDP 111"

• "PROTOCOL-RPC portmap pcnfsd request UDP"

• "PROTOCOL-RPC portmap rpc.xfsmd request UDP"

• "PROTOCOL-RPC portmap cachefsd request UDP"

• "PROTOCOL-RPC portmap cmsd request UDP"

• "PROTOCOL-RPC portmap mountd request UDP"

• "PROTOCOL-RPC portmap cachefsd request TCP"

• "PROTOCOL-RPC portmap nlockmgr request UDP"

• "PROTOCOL-RPC portmap nlockmgr request TCP"

• "PROTOCOL-RPC portmap nisd request UDP"

• "PROTOCOL-RPC network-status-monitor mon-callback request TCP"

• "PROTOCOL-RPC portmap SET attempt UDP 111"

• "PROTOCOL-RPC portmap pcnfsd request TCP"

• "PROTOCOL-RPC portmap UNSET attempt TCP 111"

• "PROTOCOL-RPC portmap admind request UDP"

• "PROTOCOL-RPC ypserv maplist request TCP"

• "PROTOCOL-RPC portmap bootparam request TCP"

• "PROTOCOL-RPC portmap sadmind request TCP"

• "PROTOCOL-RPC portmap snmpXdmi request UDP"

• "PROTOCOL-RPC portmap kcms_server request UDP"

• "PROTOCOL-RPC portmap listing UDP 111"

• "PROTOCOL-RPC portmap status request UDP"

• "PROTOCOL-RPC yppasswd new password overflow attempt UDP"

• "PROTOCOL-RPC portmap ypupdated request TCP"

• "PROTOCOL-RPC portmap yppasswd request TCP"

• "PROTOCOL-RPC portmap amountd request TCP"

• "PROTOCOL-RPC ypserv maplist request UDP"

• "PROTOCOL-RPC portmap RQUOTA request UDP"

• "PROTOCOL-RPC yppasswd username overflow attempt UDP"

• "PROTOCOL-RPC portmap NFS request TCP"

• "PROTOCOL-RPC yppasswd user update TCP"

• "PROTOCOL-RPC portmap admind request TCP"

• "PROTOCOL-RPC portmap ttdbserv request TCP"

• "PROTOCOL-RPC portmap ypserv request UDP"

• "PROTOCOL-RPC yppasswd old password overflow attempt TCP"

• "PROTOCOL-RPC portmap selection_svc request UDP"

• "PROTOCOL-RPC AMD UDP version request"

• "PROTOCOL-RPC portmap listing UDP 32771"

web-application-activity

• "SERVER-IIS UploadScript11.asp access"

• "SERVER-IIS JET VBA access"

• "SERVER-WEBAPP Advanced Poll poll_ssi.php access"

• "SERVER-WEBAPP HyperSeek hsx.cgi access"

• "SERVER-WEBAPP Multiple Vendors global.cgi access"

• "SERVER-WEBAPP Invision Board emailer.php file include"

• "SERVER-WEBAPP unify eWave ServletExec DOS"

• "SERVER-WEBAPP tst.bat access"

• "SERVER-WEBAPP register.cgi access"

• "SERVER-WEBAPP cPanel resetpass access"

• "SERVER-WEBAPP /*.shtml access"

• "SERVER-WEBAPP EasyBoard 2000 ezman.cgi access"

• "SERVER-WEBAPP viralator.cgi access"

• "SERVER-WEBAPP test.cgi access"

• "SERVER-WEBAPP parse_xml.cgi access"

• "SERVER-WEBAPP cvsview2.cgi access"

• "SERVER-WEBAPP eXtropia webstore access"

• "SERVER-WEBAPP txt2html.cgi access"

• "SERVER-IIS as_web4.exe access"

• "SERVER-WEBAPP cgiwrap access"

• "SERVER-WEBAPP agora.cgi access"

• "SERVER-WEBAPP Advanced Poll admin_logout.php access"

• "SERVER-WEBAPP webalizer access"

• "SERVER-OTHER Microsoft Frontpage cfgwiz.exe access"

• "SERVER-WEBAPP autohtml.php access"

• "SERVER-WEBAPP active.log access"

• "SERVER-WEBAPP a1stats a1disp3.cgi access"

• "SERVER-OTHER Microsoft Frontpage fpadmcgi.exe access"

• "SERVER-WEBAPP shoutbox.php access"

• "SERVER-WEBAPP DCShop access"

• "SERVER-WEBAPP /Carello/add.exe access"

• "SERVER-IIS srchadm access"

• "SERVER-WEBAPP album.pl access"

• "SERVER-OTHER HP Web JetAdmin file write attempt"

• "SERVER-WEBAPP edittag.pl access"

• "SERVER-WEBAPP directorypro.cgi access"

• "SERVER-IIS showcode.asp access"

• "SERVER-WEBAPP Oracle XSQLConfig.xml access"

• "MALWARE-CNC sensepost.exe command shell"

• "SERVER-WEBAPP bigconf.cgi access"

• "SERVER-WEBAPP philboard.mdb access"

• "SERVER-WEBAPP modules.php access"

• "SERVER-WEBAPP WEB-INF access"

• "SERVER-IIS SmarterTools SmarterMail frmCompose.asp access"

• "SERVER-IIS repost.asp access"

• "SERVER-APACHE Apache Tomcat SnoopServlet servlet access"

• "SERVER-WEBAPP login.htm attempt"

• "SERVER-WEBAPP cybercop scan"

• "SERVER-WEBAPP emumail.cgi NULL attempt"

• "SERVER-WEBAPP Cyboards default_header.php access"

• "EXPLOIT-KIT Phoenix Exploit Kit inbound geoip.php bdr exploit attempt"

• "SERVER-WEBAPP bb_smilies.php access"

• "SERVER-WEBAPP nstelemetry.adp access"

• "SERVER-WEBAPP Advanced Poll admin_edit.php access"

• "SERVER-IIS foxweb.dll access"

• "SERVER-OTHER HP Web JetAdmin file write attempt"

• "SERVER-WEBAPP /home/ftp access"

• "SERVER-WEBAPP /doc/packages access"

• "SERVER-WEBAPP Delegate whois overflow attempt"

• "SERVER-WEBAPP register.dll access"

• "SERVER-OTHER HP Web JetAdmin setinfo access attempt"

• "SERVER-WEBAPP Muscat Empower cgi access"

• "SERVER-WEBAPP /home/www access"

• "SERVER-WEBAPP Advanced Poll admin_embed.php access"

• "SERVER-WEBAPP iSoft-Solutions QuickStore shopping cart quickstore.cgi access"

• "SERVER-IIS /StoreCSVS/InstantOrder.asmx request"

• "SERVER-WEBAPP apache ?M=D directory list attempt"

• "SERVER-WEBAPP count.cgi access"

• "SERVER-WEBAPP MachineInfo access"

• "SERVER-IIS ISAPI .printer access"

• "SERVER-WEBAPP bizdbsearch access"

• "SQL queryhit.htm access"

• "SERVER-WEBAPP post32.exe access"

• "SERVER-IIS register.asp access"

• "SERVER-WEBAPP statsconfig.pl access"

• "SERVER-WEBAPP cgiforum.pl access"

• "SERVER-OTHER Microsoft Frontpage dvwssr.dll access"

• "SERVER-IIS viewcode access"

• "SERVER-WEBAPP siteUserMod.cgi access"

• "SERVER-WEBAPP ans.pl access"

• "SERVER-WEBAPP cached_feed.cgi moreover shopping cart access"

• "SERVER-WEBAPP dbman db.cgi access"

• "SERVER-WEBAPP CCBill whereami.cgi access"

• "SERVER-IIS uploadn.asp access"

• "SERVER-WEBAPP way-board.cgi access"

• "SERVER-WEBAPP rolis guestbook access"

• "SERVER-WEBAPP admentor admin.asp access"

• "SERVER-OTHER Microsoft Frontpage orders.txt access"

• "SERVER-IIS global.asa access"

• "SERVER-WEBAPP input2.bat access"

• "SERVER-WEBAPP Advanced Poll admin_password.php access"

• "SERVER-IIS bdir.htr access"

• "SERVER-OTHER Microsoft Frontpage authors.pwd access"

• "SERVER-WEBAPP cgimail access"

• "SERVER-WEBAPP smssend.php access"

• "SQL ftp attempt"

• "SERVER-WEBAPP catgy.cgi access"

• "SERVER-WEBAPP /cgi-bin/ls access"

• "SERVER-IIS adctest.asp access"

• "SERVER-WEBAPP RBS ISP /newuser access"

• "SERVER-WEBAPP Amaya templates sendtemp.pl access"

• "SERVER-WEBAPP xp_regdeletekey attempt"

• "SERVER-WEBAPP FileSeek fileseek.cgi access"

• "SERVER-WEBAPP read_body.php access attempt"

• "SERVER-WEBAPP environ.pl access"

• "SERVER-WEBAPP newdesk access"

• "SERVER-WEBAPP Emumail emumail.fcgi access"

• "SERVER-WEBAPP logicworks.ini access"

• "SERVER-WEBAPP way-board access"

• "SERVER-WEBAPP guestbook.cgi access"

• "SERVER-WEBAPP Lars Ellingsen guestserver.cgi access"

• "SERVER-WEBAPP IdeaBox notification.php file include"

• "SERVER-WEBAPP icat access"

• "SERVER-WEBAPP Blahz-DNS dostuff.php access"

• "SERVER-WEBAPP webadmin.dll access"

• "SERVER-IIS mkilog.exe access"

• "SERVER-IIS JET VBA access"

• "SERVER-WEBAPP Advanced Poll popup.php access"

• "SERVER-WEBAPP rpc-smb.pl access"

• "SERVER-IIS /SiteServer/Publishing/viewcode.asp access"

• "SERVER-OTHER Microsoft Frontpage service.stp access"

• "SERVER-WEBAPP /cgi-bin/jj access"

• "SERVER-WEBAPP printenv access"

• "SERVER-WEBAPP Mambo uploadimage.php access"

• "SERVER-IIS MS BizTalk server access"

• "SERVER-OTHER Microsoft Frontpage _vti_rpc access"

• "SERVER-WEBAPP telnet attempt"

• "SERVER-WEBAPP IBM Net.Commerce orderdspc.d2w access"

• "SERVER-WEBAPP DB4Web access"

• "SERVER-WEBAPP ad.cgi access"

• "SERVER-WEBAPP WebDAV search access"

• "SERVER-WEBAPP .bat? access"

• "SERVER-IIS bdir access"

• "SERVER-IIS trace.axd access"

• "SERVER-WEBAPP newsPHP Language file include attempt"

• "SERVER-WEBAPP pgpmail.pl access"

• "SERVER-WEBAPP Leif M. Wright simplestmail.cgi access"

• "SERVER-IIS pbserver access"

• "SERVER-OTHER Microsoft Frontpage /_vti_bin/ access"

• "SERVER-WEBAPP Advanced Poll admin_templates.php access"

• "SERVER-WEBAPP PeopleSoft PeopleBooks psdoccgi access"

• "SERVER-WEBAPP BLNews objects.inc.php4 access"

• "SERVER-IIS VP-ASP shopsearch.asp access"

• "SERVER-WEBAPP alibaba.pl access"

• "SERVER-WEBAPP spamrule.dll access"

• "SERVER-WEBAPP cwmail.exe access"

• "SERVER-WEBAPP files.inc.php access"

• "SERVER-WEBAPP BBoard access"

• "SERVER-WEBAPP Ipswitch IMail readmail.cgi access"

• "SERVER-WEBAPP ion-p access"

• "SERVER-WEBAPP IdeaBox cord.php file include"

• "SERVER-WEBAPP cachemgr.cgi access"

• "SERVER-WEBAPP pfdispaly.cgi access"

• "SERVER-WEBAPP cgforum.cgi access"

• "SERVER-WEBAPP dnewsweb.cgi access"

• "SERVER-WEBAPP PhpGedView search.php access"

• "SERVER-IIS nsiislog.dll access"

• "SERVER-WEBAPP Bugzilla doeditvotes.cgi access"

• "SERVER-WEBAPP source.jsp access"

• "SERVER-WEBAPP ISAPISkeleton.dll access"

• "SERVER-IIS httpodbc.dll access - nimda"

• "SERVER-WEBAPP zml.cgi access"

• "SERVER-WEBAPP IGeneric Free Shopping Cart page.php access"

• "SERVER-WEBAPP Advanced Poll admin_preview.php access"

• "SERVER-OTHER Microsoft Frontpage register.txt access"

• "SERVER-WEBAPP test.php access"

• "SERVER-WEBAPP ServletManager access"

• "SERVER-WEBAPP authentication_index.php access"

• "SERVER-WEBAPP GlobalFunctions.php access"

• "SERVER-WEBAPP robot.txt access"

• "SERVER-IIS exec-src access"

• "SERVER-OTHER Microsoft Frontpage shtml.dll access"

• "SERVER-WEBAPP b2 cafelog gm-2-b2.php access"

• "SERVER-WEBAPP csPassword.cgi access"

• "SERVER-WEBAPP smartsearch.cgi access"

• "SERVER-IIS site/iisamples access"

• "SERVER-WEBAPP helpout.exe access"

• "SERVER-WEBAPP util.pl access"

• "SERVER-WEBAPP cvsweb version access"

• "SERVER-WEBAPP /ecscripts/ecware.exe access"

• "SERVER-WEBAPP TextPortal admin.php default password admin attempt"

• "SERVER-WEBAPP .DS_Store access"

• "SERVER-WEBAPP readmsg.php access"

• "SERVER-WEBAPP alchemy http server PRN arbitrary command execution attempt"

• "SERVER-WEBAPP DatabaseFunctions.php access"

• "SERVER-IIS encoding access"

• "SERVER-OTHER Microsoft Frontpage contents.htm access"

• "SERVER-IIS msdac access"

• "SERVER-WEBAPP Advanced Poll admin_settings.php access"

• "SERVER-WEBAPP input.bat access"

• "SERVER-OTHER Microsoft Frontpage registrations.txt access"

• "SERVER-WEBAPP Cisco Catalyst command execution attempt"

• "SERVER-IIS as_web.exe access"

• "SERVER-WEBAPP SIX webboard generate.cgi access"

• "SERVER-WEBAPP web-map.cgi access"

• "SERVER-WEBAPP swsrv.cgi access"

• "SERVER-WEBAPP cgitest.exe access"

• "SERVER-WEBAPP phf access"

• "SERVER-WEBAPP Matt Wright download.cgi access"

• "SERVER-IIS /exchange/root.asp access"

• "SERVER-WEBAPP htgrep access"

• "SERVER-WEBAPP pagelog.cgi directory traversal attempt"

• "SERVER-WEBAPP SAP Crystal Reports crystalimagehandler.aspx access"

• "SERVER-WEBAPP bslist.cgi access"

• "SERVER-WEBAPP Ipswitch IMail printmail.cgi access"

• "SERVER-WEBAPP phpbb quick-reply.php access"

• "SERVER-WEBAPP faqmanager.cgi access"

• "SERVER-WEBAPP Messagerie supp_membre.php access"

• "SERVER-WEBAPP changepw.exe access"

• "SERVER-WEBAPP chatbox.php access"

• "SERVER-WEBAPP ustorekeeper.pl access"

• "SERVER-WEBAPP Photopost PHP Pro showphoto.php access"

• "SERVER-WEBAPP cgiWebupdate.exe access"

• "SERVER-IIS ping.asp access"

• "SERVER-IIS VP-ASP ShopDisplayProducts.asp access"

• "SERVER-WEBAPP Nortel Contivity cgiproc access"

• "SERVER-WEBAPP Turba status.php access"

• "SERVER-WEBAPP Advanced Poll admin_tpl_misc_new.php access"

• "SERVER-WEBAPP oracle portal demo access"

• "SERVER-WEBAPP php.exe access"

• "SERVER-WEBAPP Cyboards options_form.php access"

• "SERVER-WEBAPP csSearch.cgi access"

• "SERVER-WEBAPP cgiCentral WebStore ws_mail.cgi access"

• "SERVER-WEBAPP emumail.cgi access"

• "SERVER-WEBAPP .htgroup access"

• "SERVER-IIS .cnf access"

• "SERVER-WEBAPP webdist.cgi access"

• "SERVER-WEBAPP SiteScope Service access"

• "SERVER-WEBAPP bb-hostscv.sh access"

• "SERVER-WEBAPP login.htm access"

• "SERVER-WEBAPP hello.bat access"

• "SERVER-WEBAPP net attempt"

• "SERVER-WEBAPP Mambo upload.php access"

• "SERVER-IIS Synchrologic Email Accelerator userid list access attempt"

• "SERVER-WEBAPP cart.cgi access"

• "SERVER-IIS search97.vts access"

• "SERVER-OTHER Microsoft Frontpage services.cnf access"

• "SERVER-WEBAPP Axis Storpoint CD access"

• "SERVER-WEBAPP nph-publish.cgi access"

• "SERVER-WEBAPP TOP10.dll access"

• "SERVER-WEBAPP Sample_showcode.html access"

• "SERVER-WEBAPP Invision Power Board search.pl access"

• "SERVER-WEBAPP a1stats access"

• "SERVER-IIS sgdynamo.exe access"

• "SERVER-OTHER Microsoft Frontpage service.cnf access"

• "SERVER-WEBAPP .FBCIndex access"

• "SERVER-WEBAPP Apple QuickTime streaming server view_broadcast.cgi access"

• "SERVER-WEBAPP sresult.exe access"

• "SERVER-WEBAPP Infinity CGI exploit scanner nph-exploitscanget.cgi access"

• "SERVER-WEBAPP SGI InfoSearch fname access"

• "SERVER-IIS perl access"

• "SERVER-OTHER Microsoft Frontpage rad fp4areg.dll access"

• "SERVER-WEBAPP SalesLogix Eviewer access"

• "SERVER-WEBAPP ikonboard.cgi access"

• "SERVER-WEBAPP iPlanet .perf access"

• "SERVER-WEBAPP Oracle Cobalt RaQ service.cgi access"

• "SERVER-WEBAPP wsh attempt"

• "SERVER-IIS IISProtect access"

• "SERVER-WEBAPP pagelog.cgi access"

• "SERVER-WEBAPP responder.cgi access"

• "SERVER-WEBAPP cgicso access"

• "SERVER-WEBAPP basilix sendmail.inc access"

• "SERVER-IIS viewcode access"

• "SERVER-OTHER Microsoft Frontpage shtml.exe access"

• "SERVER-WEBAPP processit access"

• "SERVER-IIS webhits access"

• "INDICATOR-SCAN Webtrends HTTP probe"

• "SERVER-WEBAPP /CVS/Entries access"

• "SERVER-WEBAPP TextPortal admin.php default password 12345 attempt"

• "SERVER-IIS fpcount access"

• "SERVER-OTHER Microsoft Frontpage orders.htm access"

• "SERVER-WEBAPP Title.php access"

• "SERVER-WEBAPP alchemy http server NUL arbitrary command execution attempt"

• "SERVER-IIS _mem_bin access"

• "SERVER-WEBAPP UpdateClasses.php access"

• "SERVER-OTHER Microsoft Frontpage form_results.htm access"

• "SERVER-IIS codebrowser SDK access"

• "SERVER-WEBAPP Advanced Poll admin_stats.php access"

• "SERVER-IIS users.xml access"

• "SERVER-IIS ISAPI .idq access"

• "SERVER-WEBAPP spin_client.cgi access"

• "SERVER-WEBAPP oracle web application server access"

• "SERVER-WEBAPP document.d2w access"

• "SERVER-WEBAPP myPHPNuke partner.php access"

• "SERVER-WEBAPP Webmin Directory edit_action.cgi access"

• "SERVER-WEBAPP bash access"

• "SERVER-WEBAPP bsguest.cgi access"

• "SERVER-WEBAPP phpBB privmsg.php access"

• "SERVER-WEBAPP ax-admin.cgi access"

• "SERVER-WEBAPP cart32.exe access"

• "SERVER-WEBAPP tftp attempt"

• "SERVER-WEBAPP /fcgi-bin/echo.exe access"

• "SERVER-OTHER Microsoft Frontpage posting"

• "SERVER-WEBAPP 3R Soft MailStudio 2000 mailview.cgi access"

• "SERVER-WEBAPP DELETE attempt"

• "SERVER-WEBAPP ndcgi.exe access"

• "SERVER-WEBAPP sojourn.cgi access"

• "SERVER-IIS CGImail.exe access"

• "SERVER-WEBAPP sdbsearch.cgi access"

• "SERVER-WEBAPP ddicgi.exe access"

• "SERVER-WEBAPP htsearch access"

• "SQL xp_regread attempt"

• "SERVER-WEBAPP Alabanza Control Panel nsManager.cgi access"

• "SERVER-WEBAPP bbs_forum.cgi access"

• "SERVER-WEBAPP axs.cgi access"

• "SERVER-WEBAPP myPHPNuke chatheader.php access"

• "SERVER-WEBAPP Leif M. Wright everythingform.cgi access"

• "SERVER-WEBAPP echo.bat access"

• "SERVER-WEBAPP db2www access"

• "SERVER-IIS anot.htr access"

• "SERVER-IIS query.asp access"

• "SERVER-WEBAPP bad HTTP 1.1 request - potential worm attack"

• "SERVER-WEBAPP zml.cgi attempt"

• "SERVER-OTHER Microsoft Frontpage access.cnf access"

• "SERVER-IIS codebrowser Exair access"

• "SERVER-WEBAPP handler access"

• "SERVER-WEBAPP test.bat access"

• "SERVER-WEBAPP Advanced Poll admin_templates_misc.php access"

• "SERVER-WEBAPP ttCMS header.php access"

• "SERVER-OTHER Microsoft Frontpage fpsrvadm.exe access"

• "SERVER-WEBAPP Setup.php access"

• "SERVER-WEBAPP Netscape PublishingXpert access"

• "SERVER-WEBAPP sml3com access"

• "SERVER-WEBAPP /_admin access"

• "SERVER-WEBAPP answerbook2 admin attempt"

• "SERVER-WEBAPP ibillpm.pl access"

• "SERVER-WEBAPP redirect.exe access"

• "INDICATOR-SCAN L3retriever HTTP Probe"

• "SERVER-WEBAPP Bugtraq enter_bug.cgi access"

• "SERVER-WEBAPP phptest.php access"

• "SERVER-WEBAPP Oracle Java Process Manager access"

• "SERVER-WEBAPP basilix mysql.class access"

• "SERVER-IIS showcode access"

• "SERVER-OTHER Microsoft Frontpage svcacl.cnf access"

• "SERVER-WEBAPP rpc-nlog.pl access"

• "SERVER-IIS IISProtect siteadmin.asp access"

• "SERVER-WEBAPP loadpage.cgi access"

• "SERVER-WEBAPP Trend Micro Interscan VirusWall setpasswd.cgi access"

• "SERVER-WEBAPP rcmd attempt"

• "SERVER-WEBAPP Demarc SQL injection attempt"

• "SERVER-WEBAPP eshop.pl access"

• "SERVER-WEBAPP webhits.exe access"

• "SERVER-OTHER Microsoft Frontpage rad fp30reg.dll access"

• "SERVER-IIS newdsn.exe access"

• "SERVER-WEBAPP cal_make.pl access"

• "SERVER-IIS doctodep.btr access"

• "SERVER-WEBAPP CGIScript.net csNews.cgi access"

• "SERVER-WEBAPP NetScreen SA 5000 delhomepage.cgi access"

• "SERVER-WEBAPP setinfo.hts access"

• "SERVER-OTHER Microsoft Frontpage service.pwd"

• "SERVER-WEBAPP MatrikzGB privilege escalation attempt"

• "SERVER-WEBAPP csPassword password.cgi.tmp access"

• "SERVER-WEBAPP search.dll access"

• "SERVER-WEBAPP bsml.pl access"

• "SERVER-WEBAPP MsmMask.exe access"

• "SERVER-WEBAPP SpamExcp.dll access"

• "SERVER-WEBAPP overflow.cgi access"

• "SERVER-IIS Battleaxe Forum login.asp access"

• "SERVER-OTHER HP Web JetAdmin remote file upload attempt"

• "SERVER-IIS view source via translate header"

• "SERVER-WEBAPP ftp.pl access"

• "SERVER-WEBAPP DCShop auth_user_file.txt access"

• "SERVER-WEBAPP p-news.php access"

• "SERVER-OTHER Microsoft Frontpage fpremadm.exe access"

• "SERVER-IIS getdrvs.exe access"

• "SERVER-WEBAPP ExAir access"

• "SERVER-WEBAPP friends.php access"

• "SERVER-WEBAPP mod_gzip_status access"

• "SERVER-OTHER Microsoft Frontpage author.exe access"

• "SERVER-WEBAPP Advanced Poll admin_help.php access"

• "SERVER-WEBAPP 3Com 3CRADSL72 ADSL 11g Wireless Router app_sta.stm access attempt"

• "SERVER-IIS NewsPro administration authentication attempt"

• "SERVER-WEBAPP alert.cgi access"

• "SERVER-IIS achg.htr access"

• "SERVER-WEBAPP calendar-admin.pl access"

• "SERVER-WEBAPP vpasswd.cgi access"

• "SQL counter.exe access"

• "SERVER-WEBAPP EasyBoard 2000 ezadmin.cgi access"

• "SERVER-WEBAPP simplestguest.cgi access"

• "SERVER-WEBAPP cgiCentral WebStore imageFolio.cgi access"

• "SERVER-WEBAPP FormHandler.cgi access"

• "SERVER-WEBAPP Advanced Poll admin_tpl_new.php access"

• "SERVER-IIS ctss.idc access"

• "SERVER-IIS srch.htm access"

• "SERVER-OTHER Microsoft Frontpage register.htm access"

• "SERVER-WEBAPP Webnews.exe access"

• "SERVER-WEBAPP ContentFilter.dll access"

• "SERVER-WEBAPP Apache chunked-encoding memory corruption exploit attempt"

• "SERVER-OTHER Microsoft Frontpage form_results access"

• "SERVER-WEBAPP webfind.exe access"

• "SERVER-WEBAPP Psunami Bulletin Board psunami.cgi access"

• "SERVER-WEBAPP mkplog.exe access"

• "SERVER-WEBAPP adcycle access"

• "SERVER-IIS msadcs.dll access"

• "SERVER-WEBAPP multidiff.cgi access"

• "SERVER-WEBAPP calendar.php access"

• "SERVER-WEBAPP Faq-O-Matic fom.cgi access"

• "SERVER-WEBAPP xp_regwrite attempt"

• "SERVER-IIS SmarterTools SmarterMail frmGetAttachment.aspx access"

• "SERVER-WEBAPP MDaemon form2raw.cgi access"

• "SERVER-WEBAPP AlienForm alienform.cgi access"

• "SERVER-WEBAPP nc.exe attempt"

• "SERVER-WEBAPP philboard_admin.asp access"

• "SERVER-WEBAPP Emumail init.emu access"

• "SERVER-WEBAPP TUTOS path disclosure attempt"

• "SERVER-WEBAPP lyris.pl access"

• "SERVER-WEBAPP server-info access"

• "SERVER-WEBAPP globals.jsa access"

• "SERVER-IIS /pcadmin/login.asp access"

• "SERVER-WEBAPP auktion.cgi access"

• "SERVER-OTHER Microsoft Frontpage users.pwd access"

• "SERVER-IIS viewcode access"

• "SERVER-WEBAPP server-status access"

• "SERVER-WEBAPP Oracle Dynamic Monitoring Services dms access"

• "SERVER-IIS DirectoryListing.asp access"

• "SERVER-OTHER Microsoft Frontpage writeto.cnf access"

• "SERVER-IIS viewcode access"

• "SERVER-WEBAPP PHPBB viewforum.php access"

• "SERVER-WEBAPP globals.pl access"

• "SERVER-WEBAPP AlienForm af.cgi access"

• "SERVER-WEBAPP search.cgi access"

• "SERVER-WEBAPP dfire.cgi access"

• "SERVER-WEBAPP /doc/ access"

• "SERVER-WEBAPP edit_image.php access"

• "SERVER-WEBAPP Infonautics getdoc.cgi access"

• "SERVER-IIS postinfo.asp access"

• "SERVER-WEBAPP cvslog.cgi access"

• "SERVER-WEBAPP calendar_admin.pl access"

• "SERVER-IIS jet vba access"

• "SERVER-WEBAPP book.cgi access"

• "SERVER-WEBAPP talkback.cgi access"

• "SERVER-WEBAPP Linksys BEFSR41 gozila.cgi access"

• "SERVER-WEBAPP awstats access"

• "SERVER-WEBAPP webcart-lite access"

• "SERVER-OTHER Microsoft Frontpage registrations.htm access"

• "SERVER-IIS foxweb.exe access"

• "SERVER-WEBAPP SFNofitication.dll access"

• "SERVER-WEBAPP WAnewsletter db_type.php access"

• "SERVER-WEBAPP Advanced Poll booth.php access"

• "SERVER-IIS /iisadmpwd/aexp2.htr access"

• "SERVER-IIS MSProxy access"

• "SERVER-IIS site server config access"

• "SERVER-IIS WebDAV file lock attempt"

• "SERVER-WEBAPP VsSetCookie.exe access"

• "SERVER-WEBAPP DNSTools access"

• "SERVER-WEBAPP iChat directory traversal attempt"

• "SERVER-APACHE Apache Tomcat TroubleShooter servlet access"

• "SERVER-WEBAPP Oatmeal Studios Mail File mailfile.cgi access"

• "SERVER-IIS htimage.exe access"

• "SERVER-WEBAPP gbook.cgi access"

• "SERVER-WEBAPP alya.cgi access"

• "SERVER-WEBAPP Talentsoft Web+ internal IP Address access"

• "OS-WINDOWS Microsoft Windows WebDAV propfind access"

• "SERVER-WEBAPP EasyBoard 2000 ezboard.cgi access"

• "SERVER-WEBAPP imagemap.exe access"

• "SERVER-WEBAPP streaming server parse_xml.cgi access"

• "SERVER-WEBAPP chip.ini access"

• "SERVER-WEBAPP testcgi access"

• "SERVER-WEBAPP ministats admin access"

• "SERVER-OTHER Microsoft Frontpage _vti_inf.html access"

• "SERVER-WEBAPP store.cgi access"

• "SERVER-IIS ISAPI .ida access"

• "SERVER-WEBAPP CSMailto.cgi access"

• "SERVER-WEBAPP AHG search.cgi access"

• "SERVER-OTHER Adobe Coldfusion ?Mode=debug attempt"

• "SERVER-OTHER Microsoft Frontpage administrators.pwd access"

• "SERVER-WEBAPP Advanced Poll admin_license.php access"

• "SERVER-WEBAPP envout.bat access"

• "SERVER-IIS IISProtect globaladmin.asp access"

• "SERVER-OTHER Microsoft Frontpage fpadmin.htm access"

• "SERVER-WEBAPP robots.txt access"

• "SERVER-WEBAPP Advanced Poll admin_comment.php access"

• "SERVER-IIS viewcode.asp access"

• "SERVER-WEBAPP InteractiveQuery.jsp access"

• "SERVER-WEBAPP Oracle Reports CGI access"

• "SERVER-WEBAPP faxsurvey access"

• "SERVER-WEBAPP Poll-it access"

• "SERVER-WEBAPP DCShop orders.txt access"

• "SERVER-WEBAPP Bugtraq process_bug.cgi access"

• "SERVER-WEBAPP mod-plsql administration access"

• "SERVER-WEBAPP chipcfg.cgi access"

misc-activity

• "PROTOCOL-ICMP Reserved for Security Type 19"

• "FILE-IDENTIFY JPG file attachment detected"

• "FILE-IDENTIFY JPEG file download request"

• "INDICATOR-COMPROMISE malicious file download attempt"

• "PROTOCOL-ICMP TJPingPro1.1Build 2 Windows"

• "PROTOCOL-OTHER use of undocumented ScMM test interface in Cisco small business devices detected"

• "APP-DETECT Absolute Software Computrace outbound connection - namequery.nettrace.co.za"

• "MALWARE-CNC User-Agent known Malicious user agent Brutus AET"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "MALWARE-CNC RUX the Tick get windows directory"

• "FILE-IDENTIFY ANI file attachment detected"

• "MALWARE-BACKDOOR HackAttack 1.20 Connect"

• "PROTOCOL-ICMP Timestamp Request undefined code"

• "FILE-IDENTIFY RTF file download request"

• "INDICATOR-COMPROMISE FTP 'CWD ' possible warez site"

• "PROTOCOL-ICMP Destination Unreachable Precedence Cutoff in effect"

• "PROTOCOL-ICMP Destination Unreachable Destination Network Unknown"

• "PROTOCOL-ICMP Information Reply"

• "FILE-IDENTIFY PNG file magic detected"

• "MALWARE-BACKDOOR BackConstruction 2.1 Client FTP Open Request"

• "PUA-ADWARE InstallMetrix precheck stage outbound connection"

• "FILE-IDENTIFY SMI file attachment detected"

• "FILE-IDENTIFY Portable Executable download detected"

• "FILE-IDENTIFY JPEG file magic detection"

• "FILE-IDENTIFY RealNetworks Realplayer .rmp playlist file download request"

• "PROTOCOL-ICMP unassigned type 7"

• "FILE-IDENTIFY Microsoft Windows Audio wmf file download request"

• "FILE-IMAGE Microsoft emf file download request"

• "FILE-IDENTIFY XSLT file attachment detected"

• "FILE-IDENTIFY ZIP file download detected"

• "MALWARE-BACKDOOR Matrix 2.0 Client connect"

• "FILE-IDENTIFY XM file download request"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "PROTOCOL-ICMP Mobile Registration Request"

• "APP-DETECT PCAnywhere server response"

• "FILE-IDENTIFY PNG file attachment detected"

• "PROTOCOL-ICMP unassigned type 1"

• "PROTOCOL-ICMP PING Microsoft Windows"

• "PROTOCOL-ICMP Destination Unreachable Host Unreachable"

• "FILE-IDENTIFY Microsoft Compound File Binary v4 file magic detected"

• "FILE-IDENTIFY JPEG file magic detected"

• "PROTOCOL-ICMP Mobile Host Redirect"

• "FILE-IDENTIFY RTF file attachment detected"

• "FILE-IDENTIFY XML file magic detected"

• "FILE-IDENTIFY RTF file attachment detected"

• "PROTOCOL-ICMP Information Request undefined code"

• "FILE-IDENTIFY JPEG file magic detected"

• "INDICATOR-COMPROMISE Metasploit Meterpreter reverse HTTPS certificate"

• "PROTOCOL-ICMP PING Network Toolbox 3 Windows"

• "PROTOCOL-ICMP Destination Unreachable Host Unreachable for Type of Service"

• "FILE-IDENTIFY Microsoft Compound File Binary v3 file magic detected"

• "PROTOCOL-ICMP unassigned type 1 undefined code"

• "SERVER-WEBAPP SSL certificate with null issuer rdnSequence fields detected"

• "INDICATOR-COMPROMISE IP address check to dyndns.org detected"

• "PUA-ADWARE Win.Adware.Pbot variant outbound connection"

• "PROTOCOL-ICMP Mobile Registration Reply undefined code"

• "SERVER-MAIL SMTP relaying denied"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY XSLT file attachment detected"

• "FILE-IDENTIFY PNG file magic detected"

• "PROTOCOL-ICMP unassigned type 7 undefined code"

• "APP-DETECT Absolute Software Computrace outbound connection - 209.53.113.223"

• "INDICATOR-COMPROMISE IP address check to j.maxmind.com detected"

• "FILE-IDENTIFY SAMI file attachment detected"

• "PROTOCOL-ICMP Router Selection"

• "FILE-IDENTIFY BMP file download request"

• "FILE-IDENTIFY XLSB file magic detected"

• "PROTOCOL-ICMP PING Windows"

• "PROTOCOL-ICMP IPV6 Where-Are-You undefined code"

• "PROTOCOL-ICMP Destination Unreachable Destination Host Unknown"

• "POLICY-MULTIMEDIA vncviewer Java applet download attempt"

• "INDICATOR-COMPROMISE FTP 'MKD ' possible warez site"

• "PROTOCOL-ICMP destination unreachable port unreachable packet detected"

• "SERVER-OTHER rsyncd module list access"

• "POLICY-OTHER HP JetDirect LCD modification attempt"

• "MALWARE-CNC User-Agent known malicious user-agent string core-project"

• "FILE-IDENTIFY ANI file magic detection"

• "MALWARE-CNC RUX the Tick get system directory"

• "PUA-ADWARE InstallMetrix reporting fetch offers stage status"

• "PUA-ADWARE Win.Adware.Sendori user-agent detection"

• "APP-DETECT Absolute Software Computrace outbound connection - search.us.namequery.com"

• "PROTOCOL-ICMP PING speedera"

• "PROTOCOL-OTHER use of undocumented ScMM test interface in Cisco small business devices detected"

• "FILE-IDENTIFY JPG file attachment detected"

• "FILE-IDENTIFY JPEG file download request"

• "SERVER-OTHER bootp hardware address length overflow"

• "PROTOCOL-ICMP Redirect undefined code"

• "FILE-IDENTIFY Microsoft Compound File Binary v3 file magic detected"

• "PROTOCOL-ICMP Photuris undefined code!"

• "FILE-IDENTIFY Portable Executable binary file magic detected"

• "FILE-IDENTIFY EMF file magic detected"

• "FILE-IDENTIFY RTF file magic detected"

• "PROTOCOL-OTHER NETBIOS SMB IPC share access attempt"

• "FILE-IDENTIFY ZIP archive file download request"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "POLICY-OTHER Active Directory Federation Services policy store transfer service request detected"

• "INDICATOR-COMPROMISE Microsoft Office Discovery User-Agent to a potential URL shortener service"

• "INDICATOR-COMPROMISE Microsoft Office Discovery User-Agent to a potential URL shortener service"

• "MALWARE-BACKDOOR HidePak backdoor attempt"

• "FILE-IDENTIFY OLE Document file magic detected"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY XM file attachment detected"

• "PROTOCOL-ICMP Parameter Problem Bad Length"

• "APP-DETECT VNC server response"

• "PUA-ADWARE Win.Adware.Pbot variant outbound connection"

• "PROTOCOL-ICMP PING BeOS4.x"

• "MALWARE-OTHER Possible malicious redirect - rebots.php"

• "FILE-IDENTIFY PDF file magic detected"

• "PROTOCOL-ICMP Echo Reply undefined code"

• "PROTOCOL-ICMP PING Unix"

• "PROTOCOL-ICMP Address Mask Request undefined code"

• "PUA-ADWARE SuperOptimizer installation status"

• "PROTOCOL-ICMP Source Quench undefined code"

• "FILE-IDENTIFY JPG file attachment detected"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "PUA-ADWARE User-Agent Vitruvian"

• "FILE-IDENTIFY PDF file download request"

• "PROTOCOL-ICMP Photuris Reserved"

• "MALWARE-CNC Insane Network 4.0 connection port 63536"

• "MALWARE-BACKDOOR Y3KRAT 1.5 Connect Client Response"

• "PROTOCOL-ICMP Timestamp Reply undefined code"

• "FILE-IDENTIFY Adobe AIR file download request"

• "FILE-IDENTIFY EMF file magic detected"

• "POLICY-OTHER xtacacs login attempt"

• "PROTOCOL-ICMP Destination Unreachable Source Host Isolated"

• "INDICATOR-COMPROMISE Win.Trojan.Blocker variant outbound connection attempt"

• "PROTOCOL-ICMP Datagram Conversion Error undefined code"

• "POLICY-OTHER AFS access"

• "PROTOCOL-ICMP IPV6 Where-Are-You"

• "PUA-ADWARE Eorezo outbound connection"

• "PUA-ADWARE Eorezo get advertisement"

• "FILE-IDENTIFY PDF file attachment detected"

• "PROTOCOL-ICMP SKIP"

• "PROTOCOL-ICMP PING"

• "FILE-IDENTIFY SMI file download request"

• "PROTOCOL-ICMP IPV6 I-Am-Here undefined code"

• "PROTOCOL-ICMP Datagram Conversion Error"

• "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable"

• "FILE-IDENTIFY Adobe AIR file attachment detected"

• "APP-DETECT Bloomberg web crawler outbound connection"

• "INDICATOR-SCAN xtacacs failed login response"

• "MALWARE-BACKDOOR Y3KRAT 1.5 Connection confirmation"

• "PROTOCOL-ICMP Timestamp Request"

• "MALWARE-OTHER Request for a non-legit postal receipt"

• "PROTOCOL-ICMP Parameter Problem undefined Code"

• "PROTOCOL-DNS Malformed DNS query with HTTP content"

• "MALWARE-BACKDOOR CDK"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "SERVER-OTHER xfs overflow attempt"

• "PROTOCOL-OTHER use of undocumented ScMM test interface in Cisco small business devices detected"

• "FILE-IDENTIFY JPG file attachment detected"

• "PROTOCOL-ICMP Time-To-Live Exceeded in Transit"

• "FILE-IDENTIFY JPEG file magic detected"

• "PUA-ADWARE Adware Goobzo/CrossRider variant outbound connection"

• "PROTOCOL-ICMP Address Mask Request"

• "PUA-ADWARE SuperOptimizer encrypted data transmission"

• "PROTOCOL-ICMP Echo Reply"

• "PROTOCOL-ICMP PING Cisco Type.x"

• "FILE-IDENTIFY PNG file attachment detected"

• "PUA-ADWARE Win.Adware.Pbot variant outbound connection"

• "FILE-IDENTIFY Portable Executable binary file download request"

• "PROTOCOL-ICMP Mobile Registration Request undefined code"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY XM file attachment detected"

• "FILE-IDENTIFY XML file attachment detected"

• "FILE-IDENTIFY Microsoft Windows Media download detected"

• "PROTOCOL-OTHER NETBIOS SMB IPC share access attempt"

• "PUA-ADWARE Win.Adware.BProtector browser hijacker dll list download attempt"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "PROTOCOL-ICMP Photuris Valid Security Parameters, But Decryption Failed"

• "FILE-IDENTIFY Portable Executable download detected"

• "FILE-IDENTIFY paq8o file attachment detected"

• "MALWARE-BACKDOOR Win.Backdoor.PCRat data upload"

• "FILE-IDENTIFY Microsoft Windows EMF metafile file attachment detected"

• "FILE-IDENTIFY Portable Executable binary file magic detected"

• "PUA-ADWARE Adware Goobzo/CrossRider variant outbound connection"

• "PUA-ADWARE SuperOptimizer geolocation request"

• "PROTOCOL-ICMP IRDP router selection"

• "PROTOCOL-ICMP PING Delphi-Piette Windows"

• "MALWARE-BACKDOOR Vampire 1.2 connection request"

• "FILE-IDENTIFY JPEG file upload detected"

• "PROTOCOL-ICMP Parameter Problem Unspecified Error"

• "APP-DETECT Absolute Software Computrace outbound connection - search.namequery.com"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY XSL file attachment detected"

• "FILE-IDENTIFY paq8o file attachment detected"

• "FILE-IDENTIFY bmp file attachment detected"

• "PROTOCOL-ICMP Photuris Valid Security Parameters, But Authentication Failed"

• "FILE-IDENTIFY JPG file attachment detected"

• "PROTOCOL-ICMP SKIP undefined code"

• "FILE-IDENTIFY PDF file attachment detected"

• "PROTOCOL-ICMP Address Mask Reply undefined code"

• "FILE-IDENTIFY Portable Executable binary file magic detected"

• "PROTOCOL-ICMP PING BSDtype"

• "PROTOCOL-ICMP IPV6 I-Am-Here"

• "INDICATOR-COMPROMISE FTP 'MKD / ' possible warez site"

• "PROTOCOL-ICMP Alternate Host Address undefined code"

• "PROTOCOL-ICMP Destination Unreachable cndefined code"

• "POLICY-OTHER xtacacs accepted login response"

• "FILE-IDENTIFY Adobe AIR file attachment detected"

• "INDICATOR-OBFUSCATION known packer routine with secondary obfuscation"

• "PROTOCOL-ICMP Time-To-Live Exceeded in Transit undefined code"

• "MALWARE-CNC Asylum 0.1 connection"

• "FILE-IDENTIFY JPEG file download request"

• "PUA-ADWARE Vitruvian outbound connection"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY DIB file download request"

• "FILE-IDENTIFY JPG file attachment detected"

• "FILE-IDENTIFY Microsoft Compound File Binary v4 file magic detected"

• "FILE-IDENTIFY JPG file attachment detected"

• "INDICATOR-COMPROMISE Metasploit Meterpreter reverse HTTPS certificate"

• "PROTOCOL-ICMP PING Sniffer Pro/NetXRay network scan"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY JPEG file download request"

• "PUA-ADWARE Vitruvian outbound connection"

• "MALWARE-CNC Insane Network 4.0 connection"

• "PROTOCOL-ICMP Timestamp Reply"

• "FILE-IDENTIFY Microsoft Client Agent Helper JAR file download request"

• "MALWARE-BACKDOOR Y3KRAT 1.5 Connect"

• "INDICATOR-SCAN isakmp login failed"

• "PROTOCOL-ICMP Destination Unreachable Source Route Failed"

• "INDICATOR-COMPROMISE FTP 'STOR 1MB' possible warez site"

• "PROTOCOL-ICMP Alternate Host Address"

• "PROTOCOL-ICMP Fragment Reassembly Time Exceeded"

• "POLICY-OTHER WinGate telnet server response"

• "FILE-OFFICE Microsoft Windows RTF file with embedded object package SMTP upload attempt"

• "PROTOCOL-ICMP Address Mask Reply"

• "PROTOCOL-ICMP PING BayRS Router"

• "FILE-IDENTIFY Microsoft Office Word file download request"

• "FILE-IDENTIFY JPEG file magic detection"

• "MALWARE-BACKDOOR BackConstruction 2.1 Connection"

• "FILE-IDENTIFY XM file magic detected"

• "FILE-IDENTIFY JPG file attachment detected"

• "FILE-IDENTIFY paq8o file download request"

• "PROTOCOL-ICMP Photuris Unknown Security Parameters Index"

• "SERVER-OTHER GlobalSunTech Access Point Information Disclosure attempt"

• "FILE-IDENTIFY XSL file download request"

• "FILE-IDENTIFY XM file magic detected"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY dib file attachment detected"

• "PROTOCOL-ICMP Parameter Problem Missing a Required Option"

• "APP-DETECT Absolute Software Computrace outbound connection - search.dnssearch.org"

• "SERVER-OTHER Alcatel PABX 4400 connection attempt"

• "PROTOCOL-ICMP PING Flowpoint2200 or Network Management Software"

• "MALWARE-BACKDOOR HideSource backdoor attempt"

• "PROTOCOL-ICMP PING undefined code"

• "FILE-IDENTIFY Portable Executable binary file magic detected"

• "FILE-IDENTIFY Microsoft Windows EMF metafile file attachment detected"

• "FILE-IDENTIFY XLSB file magic detected"

• "PROTOCOL-ICMP Reserved for Security Type 19 undefined code"

• "FILE-IDENTIFY JAR file download request"

• "PROTOCOL-ICMP PING Oracle Solaris"

• "PROTOCOL-ICMP Information Request"

• "PROTOCOL-ICMP Destination Unreachable Host Precedence Violation"

• "FILE-IDENTIFY RTF file magic detected"

• "PROTOCOL-ICMP PING Ping-O-MeterWindows"

• "PROTOCOL-ICMP Destination Unreachable Network Unreachable"

• "INDICATOR-COMPROMISE FTP 'RETR 1MB' possible warez site"

• "PROTOCOL-ICMP Traceroute"

• "FILE-IDENTIFY XML file attachment detected"

• "FILE-IDENTIFY ANI file download request"

• "POLICY-OTHER HP JetDirect LCD modification attempt"

• "MALWARE-CNC RUX the Tick upload/execute arbitrary file"

• "INDICATOR-SCAN inbound probing for IPTUX messenger port "

• "PUA-ADWARE InstallMetrix reporting binary installation stage status"

• "FILE-IDENTIFY Portable Executable file attachment detected"

• "POLICY-MULTIMEDIA audio galaxy keepalive"

• "FILE-IDENTIFY XML file magic detected"

• "PUA-ADWARE SearchProtect user-agent detection"

• "PROTOCOL-OTHER use of undocumented ScMM test interface in Cisco small business devices detected"

• "PROTOCOL-ICMP PING CyberKit 2.2 Windows"

• "MALWARE-OTHER Xml.Phishing.Evernote outbound connection"

• "FILE-IDENTIFY JPEG file download request"

• "FILE-IDENTIFY JPG file attachment detected"

• "FILE-IDENTIFY SAMI file attachment detected"

• "FILE-IDENTIFY .htr access file download request"

• "FILE-IDENTIFY JPEG file magic detected"

• "INDICATOR-COMPROMISE FTP 'MKD .' possible warez site"

• "INDICATOR-COMPROMISE Metasploit Meterpreter reverse HTTPS certificate"

• "PROTOCOL-ICMP PING IP NetMonitor Macintosh"

• "FILE-OFFICE Microsoft Windows RTF file with embedded object package download attempt"

• "PROTOCOL-ICMP Mobile Registration Reply"

• "FILE-IDENTIFY JPG file attachment detected"

• "MALWARE-BACKDOOR WinCrash 1.0 Server Active"

• "FILE-IDENTIFY XSLT file download request"

• "APP-DETECT Absolute Software Computrace outbound connection - search2.namequery.com"

• "FILE-IDENTIFY PDF file magic detected"

• "FILE-IDENTIFY ZIP file attachment detected"

• "PROTOCOL-ICMP unassigned type 2"

• "APP-DETECT Absolute Software Computrace outbound connection - absolute.com"

• "FILE-IDENTIFY RealNetworks Realplayer .rt playlist file download request"

• "PROTOCOL-ICMP Redirect for TOS and Network"

• "FILE-IDENTIFY SMI file attachment detected"

• "PROTOCOL-ICMP Redirect for TOS and Host"

• "MALWARE-BACKDOOR NetBus Pro 2.0 connection request"

• "APP-DETECT Absolute Software Computrace outbound connection - bh.namequery.com"

• "FILE-IDENTIFY JPEG file magic detected"

• "FILE-IDENTIFY RealNetworks Realplayer .rp playlist file download request"

• "FILE-IDENTIFY ZIP file attachment detected"

• "PROTOCOL-ICMP unassigned type 2 undefined code"

• "POLICY-OTHER Sandvine PacketLogic http redirection attempt"

• "FILE-IDENTIFY XSL file attachment detected"

• "FILE-IDENTIFY Microsoft emf file download request"

• "APP-DETECT Absolute Software Computrace outbound connection - search64.namequery.com"

• "MALWARE-BACKDOOR Matrix 2.0 Server access"

• "FILE-IDENTIFY JAR/ZIP file magic detected"

• "FILE-IDENTIFY JPG file attachment detected"

• "INDICATOR-OBFUSCATION DNS TXT response record tunneling"

• "PROTOCOL-ICMP Mobile Host Redirect undefined code"

• "SQL ping attempt"

• "FILE-IDENTIFY RealNetworks Realplayer .ram playlist file download request"

• "MALWARE-BACKDOOR Vampire 1.2 connection confirmation"

• "PROTOCOL-ICMP PING LINUX/*BSD"

• "PROTOCOL-ICMP IRDP router advertisement"

• "FILE-IDENTIFY XML file download request"

• "MALWARE-BACKDOOR BackConstruction 2.1 Server FTP Open Reply"

• "FILE-IDENTIFY SAMI file download request"

• "FILE-IDENTIFY OLE document file magic detected"

• "FILE-IDENTIFY JPG file attachment detected"

• "PROTOCOL-ICMP PING WhatsupGold Windows"

• "MALWARE-OTHER Xml.Phishing.Evernote outbound connection"

• "FILE-IDENTIFY XML file magic detected"

• "FILE-IDENTIFY Portable Executable file attachment detected"

• "FILE-IDENTIFY ZIP file attachment detected"

• "FILE-IDENTIFY OLE Document upload detected"

• "PUA-ADWARE InstallMetrix fetch offers stage outbound connection"

• "FILE-IDENTIFY XML download detected"

• "MALWARE-CNC Asylum 0.1 connection request"

• "FILE-IDENTIFY ANI file attachment detected"

• "PROTOCOL-ICMP Traceroute undefined code"

• "FILE-IDENTIFY XML file magic detected"

• "PROTOCOL-ICMP digital island bandwidth query"

• "PROTOCOL-ICMP Destination Unreachable Network Unreachable for Type of Service"

• "INDICATOR-COMPROMISE FTP 'CWD / ' possible warez site"

• "PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set"

• "PROTOCOL-ICMP PING Pinger Windows"

• "PROTOCOL-ICMP Information Reply undefined code"

• "POLICY-OTHER FTP anonymous login attempt"

• "PROTOCOL-ICMP PING Seer Windows"

• "FILE-IDENTIFY JPEG file download request"

• "FILE-IDENTIFY JPEG file magic detected"

• "FILE-IDENTIFY JPEG file magic detected"

• "SERVER-OTHER bootp invalid hardware type"

• "PROTOCOL-ICMP Router Advertisement"

• "FILE-IDENTIFY PNG file download request"

misc-attack

• "PROTOCOL-SNMP null community string attempt"

• "SERVER-OTHER Volition Freespace 2 buffer overflow attempt"

• "SERVER-OTHER AOL Instant Messenger goaway message buffer overflow attempt"

• "PROTOCOL-FTP USER format string attempt"

• "PROTOCOL-IMAP partial body.peek buffer overflow attempt"

• "PROTOCOL-FTP LIST buffer overflow attempt"

• "PROTOCOL-IMAP lsub literal overflow attempt"

• "INDICATOR-COMPROMISE CVS invalid directory response"

• "PROTOCOL-RPC kcms_server directory traversal attempt"

• "PROTOCOL-RPC RQUOTA getquota overflow attempt UDP"

• "PROTOCOL-RPC ypupdated arbitrary command attempt TCP"

• "PROTOCOL-SNMP PROTOS test-suite-req-app attempt"

• "PROTOCOL-FTP SITE CPWD overflow attempt"

• "SERVER-OTHER CVS non-relative path access attempt"

• "PROTOCOL-IMAP examine literal overflow attempt"

• "PROTOCOL-IMAP rename literal overflow attempt"

• "PROTOCOL-IMAP status literal overflow attempt"

• "PROTOCOL-IMAP fetch overflow attempt"

• "PROTOCOL-IMAP list overflow attempt"

• "SERVER-MAIL Sendmail SOML FROM prescan too long addresses overflow"

• "PROTOCOL-IMAP APPEND overflow attempt"

• "PROTOCOL-SNMP PROTOS test-suite-trap-app attempt"

• "PROTOCOL-RPC ypupdated arbitrary command attempt UDP"

• "PROTOCOL-POP UIDL negative argument attempt"

• "INDICATOR-COMPROMISE CVS double free exploit attempt response"

• "PROTOCOL-IMAP rename overflow attempt"

• "SERVER-MAIL Vintra Mailserver expn *@"

• "SERVER-OTHER successful gobbles ssh exploit uname"

• "SERVER-OTHER AOL Instant Messenger goaway message buffer overflow attempt"

• "PROTOCOL-IMAP partial body buffer overflow attempt"

• "PROTOCOL-FTP PASS format string attempt"

• "PROTOCOL-FTP PORT bounce attempt"

• "PROTOCOL-SNMP missing community string attempt"

• "PROTOCOL-IMAP command overflow attempt"

• "PROTOCOL-FTP MKD format string attempt"

• "SERVER-WEBAPP directory.php access"

• "PROTOCOL-IMAP authenticate literal overflow attempt"

• "PROTOCOL-IMAP find overflow attempt"

• "SERVER-OTHER ICQ SRV_MULTI/SRV_META_USER overflow attempt - ISS Witty Worm"

• "PROTOCOL-RPC AMD UDP amqproc_mount plog overflow attempt"

• "PROTOCOL-FTP wu-ftp bad file completion attempt"

• "PROTOCOL-RPC sadmind query with root credentials attempt UDP"

• "OS-WINDOWS Microsoft Windows WINS overflow attempt"

• "INDICATOR-COMPROMISE Python remote shell spawn attempt"

• "PROTOCOL-FTP RENAME format string attempt"

• "PROTOCOL-RPC CMSD TCP CMSD_INSERT buffer overflow attempt"

• "SERVER-OTHER rwhoisd format string attempt"

• "PROTOCOL-IMAP unsubscribe literal overflow attempt"

• "PROTOCOL-IMAP auth overflow attempt"

• "SERVER-OTHER CDE dtspcd exploit attempt"

• "PROTOCOL-FTP wu-ftp bad file completion attempt"

• "PROTOCOL-SNMP community string buffer overflow attempt with evasion"

• "PROTOCOL-IMAP auth literal overflow attempt"

• "SERVER-OTHER CHAT IRC Ettercap parse overflow attempt"

• "SQL Worm propagation attempt"

• "PROTOCOL-RPC CMSD udp CMSD_INSERT buffer overflow attempt"

• "PROTOCOL-RPC AMD TCP amqproc_mount plog overflow attempt"

• "PROTOCOL-IMAP create buffer overflow attempt"

• "SERVER-WEBAPP CISCO VoIP DOS ATTEMPT"

• "SERVER-OTHER Unreal Tournament secure overflow attempt"

• "SERVER-OTHER bootp hostname format string attempt"

• "PROTOCOL-RPC sadmind query with root credentials attempt TCP"

• "SERVER-OTHER SSH server banner overflow"

• "PROTOCOL-RPC mountd TCP mount path overflow attempt"

• "SERVER-OTHER CVS Max-dotdot integer overflow attempt"

• "PROTOCOL-IMAP login literal buffer overflow attempt"

• "SERVER-OTHER cachefsd buffer overflow attempt"

• "SERVER-WEBAPP directory.php arbitrary command attempt"

• "SERVER-OTHER ISAKMP delete hash with empty hash attempt"

• "PROTOCOL-IMAP lsub overflow attempt"

• "SERVER-WEBAPP HTTP request with negative Content-Length attempt"

• "PROTOCOL-IMAP copy literal overflow attempt"

• "PROTOCOL-FTP RNFR ././ attempt"

• "SERVER-MAIL Sendmail SEND FROM prescan too long addresses overflow"

• "SERVER-WEBAPP CISCO PIX Firewall Manager directory traversal attempt"

• "OS-WINDOWS Microsoft Windows UPnP malformed advertisement"

• "INDICATOR-COMPROMISE CVS invalid module response"

• "PROTOCOL-IMAP list literal overflow attempt"

• "SERVER-OTHER ISAKMP initial contact notification without SPI attempt"

• "PROTOCOL-IMAP fetch literal overflow attempt"

• "SERVER-OTHER gobbles SSH exploit attempt"

• "SERVER-OTHER iParty DOS attempt"

• "PROTOCOL-RPC status GHBN format string attack"

• "OS-WINDOWS Microsoft Windows UPnP Location overflow attempt"

• "INDICATOR-COMPROMISE CVS invalid repository response"

• "PROTOCOL-IMAP append literal overflow attempt"

• "PROTOCOL-POP DELE negative argument attempt"

• "PROTOCOL-IMAP delete literal overflow attempt"

• "PROTOCOL-RPC RQUOTA getquota overflow attempt TCP"

• "PROTOCOL-IMAP create literal buffer overflow attempt"

• "PROTOCOL-SNMP community string buffer overflow attempt"

• "PROTOCOL-FTP LIST integer overflow attempt"

• "INDICATOR-COMPROMISE CVS invalid user authentication response"

• "SERVER-MAIL Sendmail SAML FROM prescan too long addresses overflow"

• "PROTOCOL-IMAP STATUS overflow attempt"

• "PROTOCOL-RPC status GHBN format string attack"

• "INDICATOR-COMPROMISE CVS non-relative path error response"

• "SERVER-OTHER ISAKMP second payload initial contact notification without SPI attempt"

• "PROTOCOL-IMAP authenticate overflow attempt"

• "INDICATOR-COMPROMISE CVS missing cvsroot response"

• "SQL Worm propagation attempt OUTBOUND"

trojan-activity

• "MALWARE-CNC Win.Trojan.iSpySoft variant outbound connection"

• "MALWARE-CNC Win.Trojan.Vawtrak variant outbound connection"

• "MALWARE-CNC Win.Trojan.Chopstick variant outbound request"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC Win.Trojan.Graftor variant inbound connection"

• "MALWARE-CNC Win.Trojan.Qarallax outbound connection"

• "MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc udpdata command"

• "MALWARE-CNC Vbs.Downloader.Agent inbound connection"

• "MALWARE-CNC Win.Trojan.yty second stage downloader initial outbound connection"

• "MALWARE-BACKDOOR DeepThroat 3.1 Connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /home.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.Nimisi variant outbound connection"

• "MALWARE-CNC Win.Trojan.Gozi/Neverquest variant outbound connection"

• "MALWARE-CNC Unix.Trojan.Vpnfilter variant outbound connection attempt"

• "MALWARE-CNC Win.Trojan.PassStealer passwords exfiltration attempt"

• "MALWARE-CNC Win.Trojan.yty file exfiltration outbound request"

• "MALWARE-CNC Win.Trojan.Zusy inbound CNC response"

• "MALWARE-CNC Bancos fake JPG encrypted config file download"

• "EXPLOIT-KIT redirection to driveby download"

• "MALWARE-CNC Win.Trojan.SDBot variant outbound connection"

• "MALWARE-CNC Win.Trojan.Injector inbound connection"

• "PUA-ADWARE Osx.Adware.Genieo variant outbound connection detected"

• "MALWARE-CNC Win.Downloader.TeamBot additional payload download attempt"

• "MALWARE-CNC Win.Trojan.UDPOS outbound command and control IP address check"

• "MALWARE-CNC Win.Trojan.Blocker variant outbound connection HTTP Header Structure"

• "MALWARE-CNC Win.Trojan.Scar variant outbound connection"

• "EXPLOIT-KIT Blackholev2/Cool exploit kit exploit download attempt"

• "MALWARE-CNC Win.Trojan.CryptoWall variant outbound connection"

• "MALWARE-BACKDOOR BackOrifice 2000 Inbound Traffic"

• "MALWARE-CNC Trojan Agent YEH variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Agent E-FAX phishing attempt"

• "MALWARE-OTHER ANDR.Trojan.iBanking outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Linux.Trojan.Mumblehard variant outbound connection"

• "MALWARE-CNC Win.Trojan.KopiLuwak variant outbound request detected"

• "MALWARE-CNC Win.Trojan.FileEncoder IP geolocation checkin attempt"

• "MALWARE-CNC Win.Trojan.Sodebral HTTP Response attempt"

• "INDICATOR-COMPROMISE MinerDeploy monitor request attempt"

• "MALWARE-TOOLS Win.Trojan.Wiper proxy communication attempt"

• "MALWARE-CNC Win.Trojan.SectorA05 outbound connection attempt"

• "EXPLOIT-KIT Nuclear exploit kit Spoofed Host Header .com- requests"

• "MALWARE-CNC Win.Worm.Steckt IRCbot executable download"

• "EXPLOIT-KIT Astrum exploit kit redirection attempt"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Houdini variant screenshot inbound init command attempt"

• "MALWARE-CNC Win.Trojan.ZeroAccess inbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Aumlib variant outbound connection"

• "MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot"

• "MALWARE-OTHER Win.Trojan.Zeus Spam 2013 dated zip/exe HTTP Response - potential malware download"

• "EXPLOIT-KIT Sibhost exploit kit"

• "MALWARE-CNC Win.Backdoor.IsSpace outbound connection"

• "MALWARE-CNC Win.Trojan.Darkhotel outbound connection"

• "MALWARE-CNC RDN Banker Data Exfiltration"

• "MALWARE-CNC Win.Backdoor.Medusa variant inbound connection"

• "MALWARE-CNC Osx.Trojan.WindTail outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "EXPLOIT-KIT Astrum exploit kit payload delivery"

• "MALWARE-CNC Andr.Trojan.Moonshine outbound connection"

• "MALWARE-CNC Potential hostile executable served from compromised or malicious WordPress site attempt"

• "EXPLOIT-KIT Blackholev2/Cool exploit kit exploit download attempt"

• "MALWARE-CNC Win.Trojan.Kuluos variant outbound connection"

• "MALWARE-CNC Andr.Trojan.AnubisCrypt variant outbound post detected"

• "MALWARE-CNC Win.Trojan.RedLeaves outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Linux.Trojan.Calfbot outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper download attempt"

• "MALWARE-CNC Win.Backdoor.DFSCook variant outbound connection"

• "MALWARE-CNC Win.Trojan.TechSupportScam installed binary outbound connection"

• "MALWARE-CNC Win.Downloader.TeamBot outbound cnc connection"

• "MALWARE-CNC Win.Trojan.Gamut configuration download"

• "MALWARE-CNC Win.Backdoor.CSBundle_Original Stager 2 download attempt"

• "MALWARE-CNC Win.Trojan.Androm variant outbound connection"

• "MALWARE-CNC BLYPT installer reuse outbound traffic"

• "MALWARE-CNC Android.CoolReaper.Trojan outbound connection"

• "MALWARE-CNC Win.Trojan.Dropper malicious executable download attempt"

• "MALWARE-CNC Win.Trojan.Kryptic 7-byte URI Invalid Firefox Headers - no Accept-Language"

• "MALWARE-CNC Win.Trojan.Pirminay variant outbound connection"

• "MALWARE-CNC Win.Backdoor.JRat inbound self-signed SSL certificate"

• "MALWARE-CNC Installation Keylogger Osx.Trojan.Mokes data exfiltration"

• "MALWARE-CNC cridex HTTP Response - default0.js"

• "MALWARE-CNC MultiOS.Trojan.OSCelestial variant outbound connection"

• "MALWARE-CNC Win.Trojan.Meredrop variant outbound connection POST Request"

• "MALWARE-OTHER Win.Worm.Dorkbot folder snkb0ptz creation attempt SMB"

• "MALWARE-CNC Deputy Dog implant outbound connection"

• "MALWARE-CNC Win.Trojan.HW32 variant spam attempt"

• "MALWARE-CNC Win.Trojan.Autophyte dropper variant outbound connection"

• "MALWARE-CNC Vbs.Trojan.Agent outbound system information disclosure"

• "MALWARE-CNC Win.Trojan.BlackRev cnc dataget command"

• "MALWARE-CNC URI request for known malicious URI - base64 encoded"

• "EXPLOIT-KIT Blackholev2/Cool exploit kit payload download attempt"

• "MALWARE-CNC Win.Trojan.Redyms variant outbound connection"

• "MALWARE-CNC Win.Trojan.Injector variant outbound connection"

• "MALWARE-CNC XP Fake Antivirus Payment Page Request"

• "MALWARE-CNC Win.Trojan.Poolfiend variant outbound connection"

• "MALWARE-CNC Win.Trojan.Symmi variant dropper download connection"

• "MALWARE-CNC MultiOS.Trojan.OSCelestial variant inbound connection"

• "MALWARE-BACKDOOR Win.Trojan.Wiper inbound communication attempt"

• "MALWARE-CNC Win.Trojan.ChoHeap variant outbound connection"

• "MALWARE-CNC Win.Trojan.Sinrin initial JS dropper outbound connection"

• "MALWARE-CNC Win.Trojan.SocketPlayer outbound connection"

• "MALWARE-CNC Win.Trojan.Necurs variant outbound connection"

• "MALWARE-CNC Win.Trojan.Tirabot variant outbound connection"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Win.Trojan.Rokrat variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.AcridRain outbound connection"

• "MALWARE-CNC Win.Trojan.Cridex encrypted POST check-in"

• "OS-MOBILE Android/Fakelash.A!tr.spy trojan command and control channel traffic"

• "MALWARE-CNC Win.Trojan.BitterRAT variant outbound connection"

• "MALWARE-CNC Win.Trojan.MadnessPro outbound connection"

• "MALWARE-CNC Win.Trojan.Kuluoz outbound connection"

• "MALWARE-CNC Win.Trojan.Zxshell variant outbound connection"

• "MALWARE-CNC Win.Trojan.HiddenCobra variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /start.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.Geodo variant outbound connection"

• "MALWARE-CNC Win.Trojan.CrossRAT outbound connection attempt"

• "EXPLOIT-KIT DotkaChef/Rmayana/DotCache exploit kit Zeroaccess download attempt"

• "MALWARE-CNC Win.Trojan.ModularInstaller variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.Careto plugin download"

• "MALWARE-CNC Win.Trojan.Ramdo variant outbound connection"

• "INDICATOR-COMPROMISE Wild Neutron potential exploit attempt"

• "MALWARE-CNC User-Agent known malicious user agent - User-Agent hello crazyk"

• "EXPLOIT-KIT Private exploit kit outbound traffic"

• "MALWARE-BACKDOOR FsSniffer connection attempt"

• "MALWARE-CNC Win.Trojan.Kraken outbound connection"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-CNC Malicious BitCoiner Miner download - Win.Trojan.Minerd"

• "MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Fexel variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string RUpdate"

• "PUA-ADWARE Vittalia adware - post install"

• "MALWARE-CNC Andr.Trojan.SMSSend outbound connection"

• "MALWARE-CNC Win.Trojan.Dapato variant inbound response connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc antiddos command"

• "POLICY-SPAM Potential phishing attack - .zip voicemail filename download with .exe name within .zip the same "

• "MALWARE-CNC Win.Trojan.Sweeper variant dropper download attempt"

• "MALWARE-CNC Win.Trojan.Kazy/FakeAV Checkin with IE6 User-Agent"

• "MALWARE-CNC Win.Trojan.Kovter variant outbound connection"

• "MALWARE-CNC DoomJuice/mydoom.a backdoor upload/execute"

• "EXPLOIT-KIT Styx exploit kit plugin detection connection jorg"

• "MALWARE-CNC Win.Trojan.BlackRev rev 2 outbound traffic"

• "MALWARE-CNC Win.Spyware.Autoit outbound connection"

• "EXPLOIT-KIT Styx exploit kit plugin detection connection jlnp"

• "PUA-TOOLBARS Win.Toolbar.Crossrider variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev rev 3 outbound traffic"

• "MALWARE-CNC Win.Backdoor.DFSCook variant outbound connection"

• "POLICY-SPAM Potential phishing attack - .zip statement filename download with .exe name within .zip the same "

• "MALWARE-CNC Win.Trojan.Glupteba C&C server HELLO request to client"

• "MALWARE-CNC Win.Ransomware.X-Mas variant keylogger outbound connection"

• "MALWARE-CNC Win.Trojan.Kazy/FakeAV Checkin with IE6 User-Agent"

• "EXPLOIT-KIT Blackhole exploit kit JavaScript carat string splitting with hostile applet"

• "INDICATOR-COMPROMISE Content-Type text/plain containing Portable Executable data"

• "PUA-ADWARE Vittalia adware outbound connection - pre install"

• "MALWARE-CNC Win.Trojan.BlackRev cnc resolve command"

• "MALWARE-CNC Win.Ransomware.Matrix outbound connection"

• "MALWARE-CNC Win.Trojan.NukeSped RAT variant outbound connection"

• "MALWARE-CNC Win.Trojan.FormBook variant outbound connection"

• "MALWARE-CNC Win.Downloader.Zebrocy initial outbound request"

• "MALWARE-CNC Win.Trojan.Fakeav variant outbound data connection"

• "MALWARE-CNC Win.Trojan.Careto outbound connection"

• "MALWARE-CNC Win.Ransomware.Urausy variant outbound connection"

• "MALWARE-CNC Win.Tinybanker variant outbound connection"

• "MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"

• "MALWARE-CNC Win.Worm.Jenxcus variant outbound connection"

• "MALWARE-CNC Win.Trojan.SpyBanker variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bandook/Anbacas outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Poseidon outbound connection"

• "MALWARE-CNC Win.Trojan.Dropper variant outbound connection"

• "MALWARE-CNC Win.Trojan.VBPasswordStealer variant outbound connection"

• "MALWARE-CNC Win.Worm.Steckt IRCbot variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /welcome.htm GET Encrypted Payload"

• "MALWARE-CNC Necurs Rootkit op.cgi"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC slapper worm admin traffic"

• "MALWARE-CNC Win.Trojan.Satana ransomware outbound connection"

• "MALWARE-CNC Win.Trojan.Agent variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent z00sAgent - Win.Trojan.Zbot"

• "MALWARE-CNC Win.Trojan.Badur download attempt"

• "MALWARE-CNC Win.Backdoor.SSLBeacon variant certificate exchange attempt"

• "EXPLOIT-KIT Rig Exploit Kit Outbound DGA Request"

• "MALWARE-CNC Win.Trojan.Poolfiend variant outbound connection"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-BACKDOOR Win.Trojan.Wiper outbound communication attempt"

• "MALWARE-CNC Win.Downloader.TeamBot additional payload download attempt"

• "MALWARE-CNC Deputy Dog implant outbound connection"

• "MALWARE-CNC Win.Trojan.TSCookie variant outbound connection"

• "MALWARE-CNC Win.Trojan.Danabot outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc connect command"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Trojan.Neurevt variant outbound connection"

• "MALWARE-CNC Win.Trojan.Nocturnal outbound connection"

• "MALWARE-CNC Win.Trojan.Pirminay variant outbout connection"

• "MALWARE-CNC Win.Trojan.ARS VBS loader outbound connection"

• "MALWARE-BACKDOOR PhaseZero Server Active on Network"

• "MALWARE-CNC Win.Backdoor.CSBundle_Original outbound connection attempt"

• "MALWARE-CNC Potential hostile executable served from compromised or malicious WordPress site"

• "MALWARE-CNC BLYPT installer configkey outbound traffic"

• "MALWARE-CNC Win.Trojan.Kryptik Drive-by Download Malware"

• "MALWARE-CNC Win.Trojan.TinyZBot outbound SOAP connection attempt"

• "MALWARE-OTHER Win.Trojan.Wiper download attempt"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Backdoor.DFSCook variant JS dropper outbound connection"

• "MALWARE-CNC Win.Trojan.TeamBot outbound cnc connection"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant send credentials"

• "MALWARE-CNC Win.Trojan.Kbot variant outbound connection"

• "MALWARE-CNC Win.Trojan.Magic variant inbound connection"

• "MALWARE-CNC Win.Trojan.Zemot payload download attempt"

• "MALWARE-CNC Andr.Trojan.AnubisCrypt variant outbound post detected"

• "MALWARE-CNC Win.Trojan.Kuluos variant outbound connection"

• "MALWARE-BACKDOOR Perl.Backdoor.PULSECHECK variant cnc connection"

• "MALWARE-CNC User-Agent known malicious user agent NOKIAN95/WEB"

• "MALWARE-CNC Win.Backdoor.Medusa variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus encrypted POST Data exfiltration"

• "EXPLOIT-KIT Astrum exploit kit payload delivery"

• "MALWARE-CNC Win.Trojan.Agent variant connection"

• "MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot"

• "MALWARE-CNC Win.Backdoor.Aumlib variant outbound connection"

• "MALWARE-CNC Win.Trojan.RedLeaves outbound connection"

• "EXPLOIT-KIT Stamp exploit kit portable executable download"

• "MALWARE-CNC Win.Trojan.Darkhotel variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection"

• "EXPLOIT-KIT Astrum exploit kit multiple exploit download request"

• "MALWARE-CNC Win.Trojan.HawkEye keylogger exfiltration attempt"

• "MALWARE-CNC Win.Trojan.UP007 variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Houdini variant keylogger inbound init command attempt"

• "MALWARE-CNC User-Agent known malicious user agent - BURAN - Win.Trojan.Buran"

• "MALWARE-TOOLS Win.Trojan.Wiper proxy tools download attempt"

• "MALWARE-CNC Win.Trojan.SectorA05 outbound connection attempt"

• "MALWARE-CNC Win.Worm.Steckt IRCbot executable download"

• "MALWARE-CNC Harakit botnet traffic"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "PUA-ADWARE Linkury outbound time check"

• "MALWARE-CNC Linux.Trojan.Elknot outbound connection"

• "MALWARE-CNC Win.Trojan.Buzus variant outbound connection"

• "MALWARE-CNC Win.Trojan.KopiLuwak variant outbound request detected"

• "MALWARE-CNC Win.Trojan.GameOverZeus variant outbound connection"

• "MALWARE-CNC Win.Worm.Luder variant outbound connection"

• "EXPLOIT-KIT Blackholev2/Darkleech exploit kit landing page"

• "MALWARE-CNC Win.Trojan.ExplorerHijack variant outbound connection"

• "MALWARE-OTHER Fake postal receipt HTTP Response phishing attack"

• "MALWARE-CNC Win.Trojan.Potao outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos outbound connection"

• "PUA-ADWARE Osx.Adware.FairyTail variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.Revenge RAT inbound heartbeat check"

• "MALWARE-CNC Win.Trojan.TeamBot outbound cnc connection"

• "MALWARE-CNC Win.Trojan.CryptoLocker variant connection"

• "MALWARE-CNC Win.Trojan.Zusy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Kraens delivery attempt"

• "MALWARE-CNC Trojan Downloader7"

• "MALWARE-CNC Win.Trojan.Zebrocy outbound data connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /install.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.Gozi/Neverquest variant outbound connection"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-CNC Win.Trojan.Gen variant outbound connection"

• "PUA-ADWARE Win.Adware.OpenSoftwareUpdater variant outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Medfos variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc data command"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC FIN4 VBA Macro credentials upload attempt"

• "MALWARE-CNC Vbs.Downloader.Agent inbound connection"

• "MALWARE-BACKDOOR DeepThroat 3.1 Server Response"

• "MALWARE-CNC User-Agent known malicious user agent - NewBrandTest"

• "MALWARE-CNC Win.Trojan.yty plugin downloader initial outbound connection"

• "MALWARE-BACKDOOR DeepThroat 3.1 Connection attempt on port 3150"

• "MALWARE-CNC Win.Trojan.iSpySoft variant exfiltration attempt"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user agent - Google Omaha - Win.Trojan.ExtenBro"

• "MALWARE-CNC Win.Trojan.Gamarue variant outbound connection"

• "MALWARE-CNC Win.Trojan.Kuluoz outbound command"

• "PUA-ADWARE User-Agent adware OutBrowse/Amonitize"

• "MALWARE-CNC Win.Trojan.iSpySoft variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC potential Rat.Tool.CSBundleUSAToday connectivity check"

• "MALWARE-CNC Win.Spyware.Invisimole CnC outbound connection"

• "PUA-ADWARE SoftPulse variant HTTP response attempt"

• "MALWARE-CNC Win.Trojan.Dropper malicious script download attempt"

• "MALWARE-CNC Win.Trojan.BasicPipeShell variant communication attempt"

• "MALWARE-CNC Win.Trojan.Kuluoz outbound connection"

• "EXPLOIT-KIT CritX exploit kit payload download attempt"

• "MALWARE-CNC Win.Trojan.Dexter Banker variant second stage download attempt"

• "EXPLOIT-KIT Magnitude exploit kit Microsoft Internet Explorer Payload request"

• "MALWARE-CNC Win.Trojan.Houdini variant initial outbound connection"

• "MALWARE-CNC Win.Trojan.Agent-ALPW variant outbound connection"

• "MALWARE-CNC MultiOS.Malware.GORAT outbound communications attempt"

• "EXPLOIT-KIT Unknown Malvertising exploit kit Hostile Jar pipe.class"

• "MALWARE-CNC HttpBrowser User-Agent outbound communication attmept"

• "MALWARE-CNC Win.Rootkit.Sednit variant outbound connection"

• "MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"

• "MALWARE-CNC Win.Trojan.HW32 variant outbound connection"

• "MALWARE-CNC Win.Trojan.Strictor HTTP Response - Brazil Geolocated Infected User"

• "MALWARE-OTHER UTF-8 BOM in zip file attachment detected"

• "MALWARE-CNC Win.Trojan.TDSS variant outbound connection"

• "MALWARE-CNC Win.Trojan.Dofoil inbound connection"

• "MALWARE-BACKDOOR Win.Trojan.Wiper inbound communication attempt"

• "MALWARE-CNC Win.Trojan.Andromeda initial outbound connection"

• "MALWARE-CNC User-Agent known malicious user agent - TixDll - Win.Trojan.Adload.dyhq"

• "MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc sleep command"

• "MALWARE-CNC Win.Trojan.Urausy Botnet variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-CNC Win.Trojan.Banload second stage download request"

• "MALWARE-OTHER Cobalt Strike beacon outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Graftor variant outbound connection"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Osx.Trojan.Gmera variant outbound connection"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Necurs Rootkit sba.cgi"

• "MALWARE-CNC Win.Trojan.Zacinlo outbound connection"

• "MALWARE-CNC Win.Trojan.BitterRAT variant outbound connection"

• "EXPLOIT-KIT Hello/LightsOut exploit kit payload download attempt"

• "MALWARE-CNC Win.Trojan.Alurewo outbound connection"

• "MALWARE-CNC Win.Trojan.Cryptowall click fraud response"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-CNC Win.Trojan.Eldorado variant outbound connection"

• "MALWARE-CNC Win.Trojan.PandaZeus malicious certificate exchange"

• "MALWARE-OTHER Fake postal receipt HTTP Response phishing attack"

• "MALWARE-CNC Win.Trojan.Kazy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Kovter variant outbound connection"

• "MALWARE-CNC Win.Trojan.FannyWorm outbound connection"

• "MALWARE-CNC Win.Worm.Gamarue variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string MSIE 4.01 - Win.Trojan.Careto"

• "MALWARE-CNC Win.Dropper.Gamaredon command and control beacon attempt"

• "MALWARE-BACKDOOR Jsp.Webshell.Chopper upload attempt"

• "MALWARE-CNC Win.Trojan.RockLoader variant outbound connection"

• "MALWARE-CNC Win/Linux.Trojan.Derusbi variant outbound connection"

• "PUA-ADWARE Sokuxuan outbound connection attempt"

• "MALWARE-BACKDOOR Jsp.Webshell.TinyUploader upload attempt"

• "INDICATOR-COMPROMISE RTF document with Equation and BITSAdmin download attempt"

• "MALWARE-CNC Win.Trojan.Agent outbound request"

• "MALWARE-CNC Win.Trojan.BlackRev cnc ftp command"

• "MALWARE-CNC Win.Trojan.Turla outbound connection"

• "MALWARE-CNC Win.Trojan.Gozi Data Theft POST Data"

• "MALWARE-CNC Win.Trojan.Glupteba C&C server READD command to client"

• "MALWARE-CNC Osx.Trojan.SHLayer variant outbound connection"

• "MALWARE-CNC Win.Trojan.DomaIQ variant outbound connection"

• "MALWARE-CNC Win.Trojan.Agent.DF - Data Exfiltration"

• "MALWARE-CNC Osx.Trojan.OceanLotus outbound connection attempt"

• "MALWARE-CNC Win.Perseus variant outbound connection"

• "MALWARE-CNC Win.Trojan.GateKeylogger outbound connection - screenshot"

• "MALWARE-CNC Win.Ransomware.X-Mas variant keylogger outbound connection"

• "MALWARE-CNC Win.Trojan.Shiz variant outbound connection"

• "MALWARE-CNC Win.Trojan.Papras variant outbound connection"

• "MALWARE-CNC Js.Trojan.Agent variant outbound connection"

• "MALWARE-CNC Kazy Trojan check-in"

• "PUA-ADWARE User-Agent adware OutBrowse/Amonitize"

• "MALWARE-CNC FBI Ransom Trojan variant outbound connection"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Win.Trojan.Napolar phishing attack"

• "MALWARE-CNC Win.Trojan.Ammy download attempt"

• "MALWARE-CNC Win.Trojan.Conficker variant outbound connection"

• "MALWARE-CNC binary download while video expected"

• "MALWARE-CNC Win.Trojan.BlackRev cnc syn command"

• "MALWARE-OTHER Compromised Website response - leads to Exploit Kit"

• "MALWARE-CNC Win.Trojan.Strictor variant outbound connection"

• "MALWARE-CNC Win.Trojan.Eupuds variant connection"

• "MALWARE-CNC Win.Trojan.NanoBot/Perseus server heartbeat request attempt"

• "MALWARE-CNC Win.Ransomware.Lockergoga binary download attempt"

• "EXPLOIT-KIT DotkaChef/Rmayana/DotCache exploit kit inbound java exploit download"

• "MALWARE-CNC Win.Trojan.Kazy variant outbound connection"

• "MALWARE-OTHER Fake Delta Ticket HTTP Response phishing attack"

• "MALWARE-CNC Win.Ransomware.Lockergoga binary download attempt"

• "MALWARE-OTHER TDS Sutra - page redirecting to a SutraTDS"

• "MALWARE-OTHER HideMeBetter spam injection variant"

• "MALWARE-CNC Win.Trojan.Adload.dyhq variant outbound connection"

• "MALWARE-CNC Win.Trojan.FTPKeyLogger outbound connection"

• "MALWARE-CNC Win.Downloader.TeamBot outbound cnc connection"

• "MALWARE-CNC Js.Trojan.FakeUpdate outbound connection"

• "MALWARE-CNC Win.Trojan.Banload information upload"

• "MALWARE-CNC Win.Trojan.Palevo outbound connection"

• "MALWARE-CNC Win.Trojan.Rovnix malicious download"

• "EXPLOIT-KIT Multiple exploit kit redirection gate"

• "MALWARE-CNC Win.Worm.VBNA variant outbound connection"

• "MALWARE-CNC Daws Trojan Outbound Plaintext over SSL Port"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection"

• "MALWARE-CNC Win.Trojan.Egamipload variant outbound connection"

• "MALWARE-CNC Win.Trojan.Cryptowall variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string - Linux.Trojan.Zollard"

• "INDICATOR-COMPROMISE Potential malware download - .gif.exe within .zip file"

• "MALWARE-BACKDOOR GateCrasher"

• "MALWARE-CNC Win.Trojan.LuminosityLink RAT variant inbound connection"

• "INDICATOR-OBFUSCATION Javascript obfuscation - seen in IFRAMEr Tool attack"

• "MALWARE-CNC User-Agent known malicious user-agent string - Andr.Trojan.Agent"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.Mapoyun variant outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Steckt IRCbot executable download"

• "MALWARE-CNC BitBot Idle C2 response"

• "MALWARE-CNC Win.Trojan.SectorA05 outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Napolar data theft"

• "MALWARE-CNC Win.Backdoor.Houdini variant screen_thumb inbound init command attempt"

• "MALWARE-CNC Win.Trojan.Graftor variant outbound connection"

• "MALWARE-CNC Win.Trojan.Asprox inbound connection"

• "MALWARE-CNC Osx.Trojan.XAgent outbound connection"

• "MALWARE-CNC Win.Trojan.Kirts initial registration"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Win.Trojan.Kuluoz Potential Phishing URL"

• "MALWARE-CNC Win.Trojan.Darkhotel outbound connection"

• "MALWARE-CNC Win.Trojan.Kabob outbound connection"

• "MALWARE-CNC Unknown malware - Incorrect headers - Referer HTTP/1.0"

• "MALWARE-CNC Win.Downloader.XAgent variant outbound connection"

• "MALWARE-CNC Win.Dropper.Clipbanker variant outbound connection"

• "MALWARE-CNC Win.Trojan.KanKan variant connection"

• "MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc allhttp command"

• "MALWARE-CNC file path used as User-Agent - potential Trojan"

• "MALWARE-CNC Win.Trojan.Locky JS dropper outbound connection"

• "MALWARE-CNC Win.Trojan.Zemot outbound connection"

• "MALWARE-BACKDOOR Perl.Backdoor.ATRIUM variant inbound cnc connection"

• "MALWARE-CNC Win.Trojan.MSDownloader variant download"

• "MALWARE-CNC Andr.Trojan.Sysch variant outbound connection"

• "MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"

• "MALWARE-CNC Win.Trojan.SpyBanker variant outbound connection"

• "EXPLOIT-KIT Glazunov exploit kit outbound jnlp download attempt"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.Napolar variant outbound connection"

• "MALWARE-CNC Win.Trojan.Dridex dropper variant outbound connection"

• "MALWARE-CNC Win.Trojan.Androm variant outbound connection"

• "EXPLOIT-KIT Glazunov exploit kit landing page"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.Bagsu variant outbound connection"

• "MALWARE-CNC Win.Trojan.Win32 Facebook Secure Cryptor C2"

• "MALWARE-CNC Andr.Trojan.Sysch variant outbound connection"

• "MALWARE-CNC Win.Trojan.Androm Click Fraud Request"

• "MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"

• "MALWARE-CNC Win.Zusy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bayrob variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zemot configuration download attempt"

• "MALWARE-BACKDOOR Perl.Backdoor.SLIGHTPULSE variant inbound cnc connection"

• "MALWARE-CNC Win.Trojan.MSDownloader variant outbound connection"

• "MALWARE-CNC Pushdo Spiral Traffic"

• "MALWARE-CNC Win.Trojan.BlackRev cnc slowhttp command"

• "MALWARE-CNC Win.Ransomware.Sage variant outbound connection"

• "MALWARE-CNC Win.Trojan.Graftor variant outbound connection"

• "MALWARE-CNC Win.Trojan.Kirts exfiltration attempt"

• "MALWARE-CNC Potential Gozi Trojan HTTP Header Structure"

• "MALWARE-CNC Win.Trojan.Kuluoz Potential phishing URL"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant keepalive"

• "MALWARE-CNC Win.Backdoor.Houdini variant screenshot inbound silence command attempt"

• "MALWARE-CNC Win-Linux.Trojan.Derusbi variant outbound connection"

• "MALWARE-CNC Osx.Downloader.MacDownloader variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.Doublepulsar variant process injection command"

• "MALWARE-CNC Win.Worm.Steckt IRCbot requesting URL through IRC"

• "MALWARE-CNC RDN Banker Strange Google Traffic"

• "MALWARE-CNC Win.Trojan.SectorA05 outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-BACKDOOR NetSphere access"

• "MALWARE-CNC Win.Trojan.LuminosityLink RAT variant outbound connection"

• "INDICATOR-COMPROMISE Potential malware download - .jpeg.exe within .zip file"

• "MALWARE-CNC Win.Trojan.Reventon variant outbound connection"

• "MALWARE-CNC Potential Win.Trojan.Kraziomel Download - 000.jpg"

• "MALWARE-CNC Brontok Worm variant outbound connection"

• "MALWARE-CNC Win.Trojan.Wiper variant outbound connection"

• "MALWARE-CNC Win.Trojan.BitterRAT variant outbound connection"

• "MALWARE-CNC Win.Trojan.Pushdo variant outbound connection"

• "MALWARE-CNC Win.Trojan.UDPOS outbound system information disclousre"

• "PUA-ADWARE Osx.Adware.MacSearch variant outbound connection detected"

• "MALWARE-CNC Win.Ransomware.Urausy outbound connection"

• "MALWARE-CNC Win.Trojan.Banload download"

• "MALWARE-CNC Win.Trojan.GateKeylogger outbound connection"

• "MALWARE-CNC Win.Trojan.Injector outbound connection"

• "MALWARE-CNC Win.Trojan.Caphaw variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc http command"

• "MALWARE-OTHER TDS Sutra - HTTP header redirecting to a SutraTDS"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant connection setup"

• "MALWARE-CNC Win.Ransomware.Lockergoga binary download attempt"

• "MALWARE-CNC Andr.Trojan.MysteryBot outbound connection"

• "MALWARE-OTHER Fake delivery information phishing attack"

• "MALWARE-CNC Win.Trojan.ZeroAccess Download Headers"

• "EXPLOIT-KIT DotkaChef/Rmayana/DotCache exploit kit landing page"

• "MALWARE-CNC Unix.Trojan.Vpnfilter variant outbound connection attempt"

• "MALWARE-CNC Linux.Backdoor.Flooder inbound connection attempt - command"

• "MALWARE-CNC Win.Trojan.BlackRev cnc udp command"

• "MALWARE-CNC Win.Trojan.Gh0st variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Trojan.Dunihi outbound connection"

• "MALWARE-CNC Win.Trojan.NanoBot/Perseus client heartbeat response attempt"

• "MALWARE-CNC Win.Trojan.CryptoWall downloader attempt"

• "MALWARE-CNC Win.Trojan.Sweeper outbound connection"

• "MALWARE-CNC Win.Trojan.Banker variant outbound connection"

• "MALWARE-CNC Win.Trojan.KeyPass variant inbound connection attempt"

• "PUA-ADWARE User-Agent adware OutBrowse/Amonitize"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string Updates downloader - Win.Trojan.Upatre"

• "EXPLOIT-KIT Goon/Infinity exploit kit payload download attempt"

• "MALWARE-CNC Win.Trojan.Travnet Botnet data upload"

• "MALWARE-OTHER Fake bookingdetails HTTP Response phishing attack"

• "MALWARE-CNC Js.Trojan.Agent variant inbound payload download"

• "MALWARE-CNC Win.Trojan.iSpy variant initial outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev rev 1 outbound traffic"

• "MALWARE-CNC Win.Trojan.Marap outbound beacon detected"

• "MALWARE-CNC Win.Trojan.Engr variant outbound connection"

• "PUA-ADWARE Osx.Adware.SurfBuyer adware outbound connection detected"

• "MALWARE-CNC Win.Trojan.Gozi Trojan Data Theft POST URL"

• "MALWARE-CNC Win.Trojan.Glupteba C&C server READY command to client"

• "MALWARE-OTHER known malicious FTP login banner - 0wns j0"

• "MALWARE-CNC Win.Trojan.Graftor variant outbound connection"

• "MALWARE-CNC Win.Trojan.Agent.DF - User-Agent Missing Bracket"

• "MALWARE-CNC Win.Trojan.Elise.B variant outbound connection"

• "MALWARE-CNC Win.Trojan.GateKeylogger plugins download attempt"

• "MALWARE-CNC Win.Ransomware.X-Mas outbound connection"

• "PUA-ADWARE Vittalia adware - get ads"

• "MALWARE-CNC Win.Trojan.BlackRev cnc range command"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "INDICATOR-COMPROMISE Unix.Backdoor.Cdorked redirect attempt"

• "MALWARE-CNC Unknown Thinner Encrypted POST botnet C&C"

• "INDICATOR-COMPROMISE RTF document with Equation and BITSAdmin download attempt"

• "MALWARE-CNC Win.Trojan.Skintrim variant outbound connection"

• "MALWARE-CNC Andr.Trojan.Scarelocker outbound connection"

• "MALWARE-CNC Andr.Trojan.Femas variant outbound connection"

• "MALWARE-CNC Win.Trojan.ModularInstaller variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.Zebrocy variant payload download attempt"

• "MALWARE-CNC Win.Trojan.Ursnif outbound connection"

• "MALWARE-BACKDOOR Jsp.Webshell.Noop download attempt"

• "MALWARE-CNC Win.Trojan.Banload variant outbound connection"

• "MALWARE-OTHER Fake bookinginfo HTTP Response phishing attack"

• "MALWARE-CNC Win.Trojan.Fakewmi variant outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Necurs variant outbound connection"

• "MALWARE-CNC Win.Trojan.HiddenCobra variant outbound connection"

• "MALWARE-CNC Orbit Downloader denial of service update"

• "MALWARE-CNC Win.Trojan.Joanap variant outbound connection"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zacinlo outbound connection"

• "MALWARE-CNC Win.Trojan.BitterRAT variant outbound connection"

• "MALWARE-OTHER Cobalt Strike beacon outbound connection attempt"

• "MALWARE-OTHER Mac OSX FBI ransomware"

• "MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"

• "MALWARE-OTHER TDS Sutra - redirect received"

• "MALWARE-CNC Win.Trojan.BlackRev cnc simple command"

• "MALWARE-TOOLS GhostPack Rubeus kerberos request attempt"

• "MALWARE-CNC Win.Trojan.FTPKeyLogger geolocation check"

• "MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"

• "MALWARE-CNC Win.Trojan.ChoHeap variant outbound connection"

• "MALWARE-CNC Win.Trojan.UDPOS outbound data exfiltration"

• "MALWARE-BACKDOOR Remote PC Access connection"

• "MALWARE-CNC Win.Trojan.Bedep initial outbound connection"

• "MALWARE-CNC Win.Trojan.Namihno variant outbound request"

• "MALWARE-CNC MultiOS.Malware.GORAT outbound communications attempt"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC Win.Trojan.Orcus RAT inbound SSL certificate"

• "MALWARE-OTHER UTF-8 BOM in zip file attachment detected"

• "MALWARE-CNC Win.Trojan.Graftor variant HTTP Response"

• "MALWARE-CNC Win.Backdoor.StoneDrill get commands outbound connection"

• "EXPLOIT-KIT Redkit exploit kit payload request"

• "EXPLOIT-KIT CritX exploit kit payload download attempt"

• "MALWARE-CNC Win.Trojan.Dexter Banker variant successful installation report attempt"

• "INDICATOR-COMPROMISE Binary file download request from internationalized domain name using Microsoft BITS"

• "MALWARE-CNC Rat.Tool.CSBundleUSATodayServer variant inbound command attempt"

• "MALWARE-CNC Win.Trojan.Derusbi.A variant outbound connection"

• "MALWARE-CNC Win.Trojan.Rombrast Trojan outbound connection"

• "MALWARE-CNC Win.Trojan.Dropper initial outbound connection attempt"

• "MALWARE-CNC Potential Banking Trojan Config File Download"

• "MALWARE-CNC Win.Trojan.PRISM variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string pb - Htbot"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string - X-Mas"

• "EXPLOIT-KIT Rawin exploit kit outbound java retrieval"

• "MALWARE-CNC Win.Trojan.GateKeylogger initial exfiltration attempt"

• "MALWARE-OTHER known malicious FTP quit banner - Goodbye happy r00ting"

• "MALWARE-CNC Win.Backdoor.ZxShell connection incoming attempt"

• "MALWARE-CNC Win.Trojan.Linkup outbound connection"

• "MALWARE-CNC Win.Trojan.Glupteba payload download request"

• "MALWARE-CNC Win.Trojan.SpySmall variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.BlackRev cnc fastddos command"

• "MALWARE-CNC Unix.Trojan.Vpnfilter variant SSL connection attempt"

• "MALWARE-BACKDOOR Perl.Backdoor.SLIGHTPULSE variant inbound cnc connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Win.Trojan.Dropper variant outbound connection"

• "MALWARE-CNC Linux.DDoS.D93 outbound connection"

• "MALWARE-BACKDOOR Win.Backdoor.Wekby Torn variant outbound connection"

• "MALWARE-BACKDOOR Jsp.Webshell.Noop upload attempt"

• "MALWARE-CNC Win.Trojan.Magania variant outbound connection"

• "MALWARE-CNC Andr.Trojan.Femas variant outbound connection"

• "MALWARE-CNC Win.Trojan.ModularInstaller variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "POLICY-OTHER Polycom Botnet inbound connection attempt"

• "MALWARE-CNC Trojan Banker FTC variant outbound connection"

• "MALWARE-CNC Win.Trojan.Hydraq.variant outbound detected"

• "MALWARE-CNC WIN.Trojan.Plugx variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fakewmi variant outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Strictor variant outbound connection"

• "MALWARE-CNC Win.Trojan.Graftor variant outbound connection"

• "INDICATOR-COMPROMISE config.inc.php in iframe"

• "MALWARE-CNC Win.Trojan.Ismdoor variant outbound connection"

• "MALWARE-CNC Win.Trojan.BitterRAT variant outbound connection"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos password stealing attempt"

• "MALWARE-CNC Linux.Trojan.Bifrose outbound connection"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC Win.Trojan.Symmi variant network connectivity check"

• "MALWARE-CNC Rat.Tool.FeyeYelp variant outbound beacon attempt"

• "MALWARE-BACKDOOR Win.Backdoor.Boda Malware Checkin"

• "MALWARE-CNC Win.Trojan.CryptoWall outbound connection"

• "INDICATOR-COMPROMISE Potential malware download - .jpg.exe within .zip file"

• "MALWARE-TOOLS GhostPack Rubeus kerberos request attempt"

• "MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"

• "MALWARE-CNC Win.Ransomware.Lockergoga binary download attempt"

• "MALWARE-CNC TDS Sutra - request in.cgi"

• "MALWARE-CNC Linux.Backdoor.Flooder outbound telnet connection attempt"

• "MALWARE-BACKDOOR Win.Trojan.Wiper download attempt"

• "MALWARE-CNC Win.Trojan.Zusy variant outbound connection"

• "MALWARE-CNC Win.Trojan.GateKeylogger outbound connection"

• "MALWARE-CNC Win.Trojan.ExplorerHijack variant outbound connection"

• "MALWARE-OTHER TDS Sutra - request hi.cgi"

• "MALWARE-CNC Win.Trojan.MadMax implant outbound connection"

• "MALWARE-CNC Cbeplay Ransomware variant outbound connection - Abnormal HTTP Headers"

• "MALWARE-CNC Win.Trojan.Copperhedge outbound connection"

• "MALWARE-BACKDOOR MultiOS.Malware.GORAT malware download attempt"

• "MALWARE-CNC Vbs.Trojan.Agent outbound connection"

• "MALWARE-CNC Potential Bancos Brazilian Banking Trojan Browser Proxy Autoconfig File"

• "MALWARE-CNC Win.Trojan.Uroburos usermode-centric client request"

• "MALWARE-CNC Win.Backdoor.StoneDrill login outbound connection"

• "MALWARE-CNC Win.Trojan.PLEAD downloader outbound connection"

• "MALWARE-CNC Win.Trojan.TorrentLocker/Teerac self-signed certificate"

• "MALWARE-CNC Win.Trojan.Banbra variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zbot/Bublik outbound connection"

• "MALWARE-CNC Win.Trojan.Zusy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Dridex self-signed certificate exchange"

• "MALWARE-CNC Win.Trojan.Rombrast Trojan outbound connection"

• "MALWARE-CNC Win.Trojan.Cridex Encrypted POST w/ URL Pattern"

• "MALWARE-CNC Win.Trojan.Dorkbot variant outbound connection"

• "MALWARE-CNC Rat.Tool.CSBundleUSATodayServer variant inbound command attempt"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC User-Agent known malicious user agent - User-Agent User-Agent Mozilla"

• "MALWARE-CNC Win.Trojan.Bagsu variant outbound connection"

• "MALWARE-CNC Win32/Autorun.JN variant outbound connection"

• "PUA-ADWARE Osx.Adware.SurfBuyer adware outbound connection detected"

• "MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"

• "MALWARE-CNC Win.Trojan.SpyBanker variant outbound connection"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Win.Trojan.Androm Click Fraud Request"

• "MALWARE-BACKDOOR Perl.Backdoor.HARDPULSE variant inbound cnc connection"

• "MALWARE-CNC DeputyDog diskless method outbound connection"

• "MALWARE-BACKDOOR Jsp.Webshell.Behinder download attempt"

• "MALWARE-CNC Win.Trojan.Delf variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"

• "EXPLOIT-KIT Nuclear exploit kit outbound payload request"

• "MALWARE-CNC Win.Trojan.Godzilla downloader successful base64 binary download"

• "MALWARE-CNC Win.Trojan.Rombrast variant outbound connection"

• "MALWARE-CNC Win.Trojan.Asprox outbound connection"

• "MALWARE-CNC Win.Trojan.Wecod variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bredolab variant outbound connection"

• "MALWARE-CNC Win-Linux.Trojan.Derusbi variant outbound connection"

• "MALWARE-CNC Win.Trojan.Qakbot variant network speed test"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant check logs"

• "MALWARE-CNC Orbit Downloader denial of service update"

• "MALWARE-CNC RDN Banker POST variant outbound connection"

• "MALWARE-CNC Win.Trojan.Doublepulsar variant ping command"

• "MALWARE-CNC Win.Trojan.Pirminay variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.Banload variant outbound connection"

• "MALWARE-CNC Win.Trojan.iSpy variant exfiltration outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "PUA-ADWARE Lucky Leap Adware outbound connection"

• "MALWARE-CNC Win.Trojan.Symmi variant HTTP response attempt"

• "MALWARE-CNC Win.Trojan.Symmi variant SQL check-in"

• "MALWARE-CNC Win.Trojan.Foreign variant outbound connection - /html2/"

• "MALWARE-CNC Dapato banking Trojan variant outbound connection"

• "MALWARE-CNC Win.Ransomware.CryptoLocker binary download response attempt"

• "MALWARE-CNC Win.Trojan.Andromeda HTTP proxy response attempt"

• "MALWARE-CNC Win.Trojan.BlackRAT variant outbound connection"

• "MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"

• "MALWARE-CNC Win.Trojan.Injector variant outbound connection"

• "MALWARE-CNC Win.Trojan.UDPOS outbound data exfiltration"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /online.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.FTPKeyLogger outbound connection"

• "MALWARE-CNC Win.Trojan.Rovnix malicious download request"

• "MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Win.Trojan.DNSChanger variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc stop command"

• "MALWARE-CNC Win.Trojan.Androm variant outbound connection"

• "MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"

• "MALWARE-CNC Win.Trojan.Conficker variant outbound connection"

• "MALWARE-BACKDOOR DeepThroat 3.1 Server Response on port 4120"

• "MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC Win.Trojan.MirageFox variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc loginpost command"

• "MALWARE-CNC Andr.Trojan.Agent variant outbound connection"

• "MALWARE-CNC Win.Backdoor.CSBundle_Original inbound connection attempt"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "EXPLOIT-KIT Sakura exploit kit exploit payload retrieve attempt"

• "MALWARE-CNC Win.Trojan.Banker variant outbound connection"

• "MALWARE-CNC Win.Trojan.Sweeper outbound connection"

• "MALWARE-OTHER Cobalt Strike beacon outbound connection attempt"

• "MALWARE-CNC Win.Trojan.CowerSnail initial outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Trojan.Meredrop variant outbound connection GET Request"

• "MALWARE-CNC Win.Trojan.Zacinlo outbound connection"

• "MALWARE-CNC Win.Trojan.Dropper outbound connection"

• "MALWARE-CNC Win.Trojan.Androm variant outbound connection"

• "MALWARE-CNC Win.Trojan.CowerSnail command and control response detected"

• "MALWARE-CNC Win.Trojan.Sweeper outbound connection"

• "MALWARE-OTHER Cobalt Strike beacon inbound connection attempt"

• "MALWARE-CNC Win.Trojan.NanoBot/Perseus initial outbound connection"

• "MALWARE-BACKDOOR Doly variant outbound connection attempt"

• "MALWARE-CNC Win.Trojan.MirageFox variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC Win.Trojan.Hydraq variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc datapost command"

• "MALWARE-CNC Win.Backdoor.CSBundle_Original stager outbound connection attempt"

• "MALWARE-CNC Win.Adware.Doyo initial connection"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "MALWARE-CNC Android.Trojan.SpyNote RAT variant getContacts command response"

• "MALWARE-CNC Win.Trojan.Kazy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Conficker variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection - MSIE7 No Referer No Cookie"

• "MALWARE-CNC Win.Trojan.Gamarue variant outbound connection"

• "MALWARE-CNC Win.Trojan.FTPKeyLogger outbound connection"

• "MALWARE-CNC Win.Backdoor.NanoBot variant inbound connection"

• "MALWARE-CNC Win.Trojan.Tiny variant outbound connection"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc die command"

• "MALWARE-CNC Win.Trojan.Symmi outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRAT variant inbound connection"

• "MALWARE-CNC Win.Trojan.Andromeda download request"

• "MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"

• "INDICATOR-COMPROMISE potential malware download - single digit .exe file download"

• "MALWARE-CNC Win.Trojan.UDPOS outbound heartbeat"

• "MALWARE-OTHER SQL Slammer worm propagation attempt inbound"

• "MALWARE-CNC Win.Trojan.Banload variant outbound connection"

• "MALWARE-CNC MultiOS.Malware.GORAT command and control SSL certificate"

• "MALWARE-CNC Win.Trojan.CryPy ransomware variant outbound connection"

• "MALWARE-CNC Win.Trojan.Gamarue - Mozi1la User-Agent"

• "MALWARE-CNC Win.Trojan.Amadey botnet outbound connection"

• "MALWARE-CNC Win.Rootkit.Necurs possible URI with encrypted POST"

• "INDICATOR-OBFUSCATION Javascript obfuscation - split - seen in IFRAMEr Tool attack"

• "MALWARE-CNC Win.Trojan.Beebone outbound connection"

• "MALWARE-CNC Win.Trojan.Qbot variant outbound connection"

• "PUA-ADWARE Lucky Leap Adware outbound connection"

• "INDICATOR-COMPROMISE JNDI LDAP searchResEntry dynamic code download attempt"

• "MALWARE-CNC Orbit Downloader denial of service update"

• "EXPLOIT-KIT Sweet Orange exploit kit landing page in.php base64 uri"

• "MALWARE-CNC Win.Trojan.Trans variant outbound connection"

• "EXPLOIT-KIT Nuclear exploit kit payload request"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win-Linux.Trojan.Derusbi variant outbound connection"

• "MALWARE-CNC Win.Trojan.Qakbot variant outbound connection"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant registration message"

• "MALWARE-CNC Win.Backdoor.Houdini variant file enumeration inbound init/root/faf command attempt"

• "MALWARE-CNC Win.Trojan.BancosBanload variant outbound connection"

• "MALWARE-CNC Win.Trojan.Babar outbound connection"

• "MALWARE-CNC Win.Agent.BHHK variant outbound connection"

• "MALWARE-CNC Win.Trojan.Asprox outbound connection"

• "MALWARE-CNC Win.Trojan.Delf variant HTTP Response"

• "MALWARE-CNC Win.Trojan.Injector variant outbound connection"

• "MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"

• "MALWARE-BACKDOOR Perl.Backdoor.STEADYPULSE variant inbound cnc connection"

• "MALWARE-CNC Win.Trojan.Asprox/Kuluoz variant connection"

• "MALWARE-CNC Win.Trojan.MSDownloader variant download"

• "MALWARE-BACKDOOR Jsp.Webshell.Chopper webshell download attempt"

• "EXPLOIT-KIT Portable Executable downloaded with bad DOS stub"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant connection setup"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Win.Trojan.Androm variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.Bagsu variant outbound connection"

• "INDICATOR-OBFUSCATION JavaScript built-in function parseInt appears obfuscated - likely packer or encoder"

• "MALWARE-CNC ZeroAccess Encrypted 128-byte POST No Accept Headers"

• "MALWARE-CNC Win.Trojan.ZeroAccess 111-byte URL variant outbound connection"

• "MALWARE-CNC Win.Trojan.Mevade variant outbound connection"

• "MALWARE-CNC Win.Trojan.Rovnix variant outbound connection"

• "MALWARE-CNC Unix.Malware.Drovorub cnc inbound connection attempt"

• "MALWARE-CNC Win.Trojan.Houdini backdoor file download request"

• "MALWARE-CNC Win.Trojan.Ammy heartbeat"

• "MALWARE-CNC Win.Trojan.BasicPipeShell variant communication attempt"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "PUA-ADWARE FakeAV runtime detection"

• "EXPLOIT-KIT DotkaChef/Rmayana/DotCache exploit kit inbound java exploit download"

• "MALWARE-CNC Win.Backdoor.StoneDrill server selection outbound connection"

• "MALWARE-CNC Win.Trojan.PLEAD downloader outbound connection"

• "MALWARE-CNC Win.Trojan.Banbra HTTP Header Structure"

• "MALWARE-CNC Win.Trojan.Strictor HTTP Response - Non-Brazil Geolocated Infected User"

• "MALWARE-OTHER UTF-8 BOM in zip file attachment detected"

• "MALWARE-CNC ZeroAccess Clickserver callback"

• "EXPLOIT-KIT Unknown Malvertising exploit kit stage-1 redirect"

• "MALWARE-OTHER TDS Sutra - redirect received"

• "MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange"

• "MALWARE-CNC Cbeplay Ransomware variant outbound connection - POST Body"

• "MALWARE-CNC Vbs.Trojan.Agent inbound payload download"

• "MALWARE-BACKDOOR MultiOS.Malware.GORAT malware download attempt"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Linux.Backdoor.Flooder outbound connection"

• "EXPLOIT-KIT DotkaChef/Rmayana/DotCache exploit kit Malvertising Campaign URI request"

• "MALWARE-BACKDOOR Perl.Backdoor.ATRIUM variant inbound cnc connection"

• "MALWARE-BACKDOOR Win.Trojan.Wiper outbound communication attempt"

• "EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"

• "POLICY-OTHER NetSupport Manager RAT outbound connection detected"

• "MALWARE-CNC Win.Trojan.GateKeylogger outbound connection - keystorkes"

• "INDICATOR-COMPROMISE Potential malware download - .pdf.exe within .zip file"

• "MALWARE-TOOLS GhostPack Rubeus kerberos request attempt"

• "MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"

• "MALWARE-CNC Win.Ransomware.Lockergoga binary download attempt"

• "MALWARE-CNC User-Agent known malicious user-agent string - Mazilla/5.0 - Win.Backdoor.Upatre"

• "MALWARE-CNC Win.Trojan.Symmi variant network connectivity check"

• "MALWARE-CNC Rat.Tool.FeyeYelp variant outbound beacon attempt"

• "MALWARE-CNC Win.Trojan.Unruy outbound callout"

• "INDICATOR-COMPROMISE Potential malware download - .doc.exe within .zip file"

• "MALWARE-CNC Win.Trojan.Ismdoor variant outbound connection"

• "MALWARE-CNC Win.Trojan.BitterRAT variant outbound connection"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Win.Trojan.Pony HTTP response connection"

• "MALWARE-CNC Win.Trojan.ZeroAccess variant outbound connection"

• "EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from NatPay Mailing Campaign"

• "EXPLOIT-KIT Glazunov exploit kit zip file download"

• "MALWARE-CNC Win.Trojan.Kryptic variant outbound connection"

• "MALWARE-CNC Win.Trojan.PandaZeus self-signed certificate exchange"

• "POLICY-OTHER Polycom Botnet inbound connection attempt"

• "MALWARE-CNC Win.Trojan.Proxyier variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Wekby Torn variant outbound connection"

• "MALWARE-BACKDOOR Jsp.Webshell.Behinder upload attempt"

• "MALWARE-CNC Win.Trojan.Critroni certificate exchange"

• "MALWARE-CNC Win.Trojan.ModularInstaller variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.Zebrocy variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc full command"

• "MALWARE-CNC User-Agent known malicious user-agent string - realupdate - Win.Backdoor.Upatre"

• "EXPLOIT-KIT Blackholev2/Cool exploit kit payload download attempt"

• "MALWARE-CNC Win.Trojan.Zbot fake PNG config file download without User-Agent"

• "MALWARE-CNC Unix.Trojan.Vpnfilter variant SSL connection attempt"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Win.Trojan.Locky variant outbound connection"

• "MALWARE-CNC Win.Trojan.Graftor variant outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc download command"

• "MALWARE-CNC Win.Trojan.Agent outbound request"

• "MALWARE-CNC Win.Trojan.Injector Info Stealer Trojan variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string - Win.Trojan.Perseus"

• "MALWARE-CNC Win.Trojan.GateKeylogger fake 404 response"

• "MALWARE-CNC Win.Backdoor.ZxShell connection outgoing attempt"

• "MALWARE-CNC Win.Trojan.Glupteba client response/authenticate to C&C server"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.SpySmall variant outbound connection"

• "MALWARE-CNC Win.Trojan.PRISM variant outbound connection"

• "MALWARE-CNC Win.Trojan.Blocker Download"

• "MALWARE-CNC Win.Trojan.Kovter outbound connection"

• "MALWARE-CNC Win.Trojan.ITranslator variant outbound connection"

• "INDICATOR-COMPROMISE Content-Type image containing Portable Executable data"

• "MALWARE-CNC Win.Trojan.Dropper outbound encrypted traffic - potential exfiltration"

• "MALWARE-CNC Potential hostile executable served from compromised or malicious WordPress site attempt"

• "POLICY-SPAM Potential phishing attack - .zip receipt filename download with .exe name within .zip the same "

• "MALWARE-CNC Win.Backdoor.DFSCook variant temporary redirect attempt"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant failed read logs"

• "MALWARE-CNC Win.Trojan.Gen variant outbound communication"

• "MALWARE-CNC Win.Trojan.Jackpos outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection"

• "MALWARE-BACKDOOR Perl.Backdoor.STEADYPULSE webshell variant access"

• "MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"

• "MALWARE-CNC Win.Trojan.NukeSped RAT variant outbound communication"

• "MALWARE-CNC Win.Trojan.Careto plugin download"

• "MALWARE-CNC Win.Trojan.Silence variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.Banker variant outbound connection"

• "MALWARE-OTHER Malicious UA detected on non-standard port"

• "PUA-ADWARE MindSpark framework installer attempt"

• "MALWARE-CNC Win.Trojan.XpertRAT outbound connection"

• "MALWARE-CNC Osx.Trojan.WindTail outbound connection"

• "MALWARE-CNC Win.Trojan.Darkhotel response connection attempt"

• "MALWARE-OTHER Alureon - Malicious IFRAME load attempt"

• "MALWARE-CNC Win.Trojan.HawkEye keylogger exfiltration attempt"

• "MALWARE-CNC Worm.Silly variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Houdini variant initial outbound connection"

• "EXPLOIT-KIT Astrum exploit kit payload delivery"

• "MALWARE-CNC Win.Worm.Steckt IRCbot variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection - getcomando POST data"

• "MALWARE-OTHER Win.Trojan.Wiper download attempt"

• "MALWARE-CNC Win.Trojan.Dropper outbound encrypted traffic"

• "MALWARE-CNC Bancos variant outbound connection SQL query POST data"

• "MALWARE-CNC Win.Trojan.Hancitor variant outbound connection"

• "MALWARE-CNC Win.Trojan.Glupteba.M initial outbound connection"

• "MALWARE-CNC Win.Ransomware.Satan outbound connection"

• "MALWARE-CNC BLYPT installer tserror outbound traffic"

• "EXPLOIT-KIT CritX exploit kit payload request"

• "MALWARE-BACKDOOR Zollard variant outbound connection attempt"

• "MALWARE-OTHER ANDR.Trojan.iBanking outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Foreign variant outbound connection - MSIE 7.2"

• "MALWARE-CNC Win.Backdoor.Medusa variant outbound connection"

• "MALWARE-CNC MultiOS.Malware.GORAT command and control response attempt"

• "EXPLOIT-KIT Blackholev2/Darkleech exploit kit landing page request"

• "MALWARE-CNC OSX.Trojan.Flashfake variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper download attempt"

• "MALWARE-CNC Win.Trojan.SpyBanker.ZSL variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fakeavlock variant outbound connection"

• "MALWARE-CNC Win.Trojan.Revenge RAT initial outbound connection"

• "MALWARE-CNC Win.Downloader.TeamBot additional payload download attempt"

• "MALWARE-CNC Osx.Trojan.Keydnap variant initial backdoor download attempt"

• "MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"

• "MALWARE-CNC Win.Trojan.Cidox variant outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection - ksa.txt"

• "MALWARE-CNC Win.Trojan.Kbot variant outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent - DNS Changer"

• "MALWARE-CNC Win.Trojan.Kraens delivery attempt"

• "PUA-ADWARE Win.Adware.OpenSoftwareUpdater variant outbound connection attempt"

• "MALWARE-CNC Android.Trojan.SpyNote RAT variant getSMS command response"

• "MALWARE-CNC Win.Backdoor.Iniduoh variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant inbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /default.htm GET Encrypted Payload"

• "MALWARE-BACKDOOR Win.Backdoor.Chopper webshell inbound request attempt"

• "MALWARE-OTHER Sinkhole reply - irc-sinkhole.cert.pl"

• "MALWARE-BACKDOOR DeepThroat 3.1 Server Response on port 3150"

• "MALWARE-CNC Win.Adware.Doyo client outbound connection"

• "MALWARE-CNC Win.Trojan.BlackRev cnc icmp command"

• "MALWARE-CNC Linux.Backdoor.Shellbot outbound connection"

• "MALWARE-CNC Win.Trojan.Dridex certificate exchange"

• "MALWARE-CNC Win.Trojan.Danabot outbound connection"

• "MALWARE-CNC Win.Trojan.TinyZBot response connection attempt"

• "MALWARE-OTHER Win.Trojan.Kuluoz outbound download request"

• "MALWARE-CNC Win.Trojan.WEC variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC Win.Trojan.Chopstick variant outbound request"

• "MALWARE-CNC Win.Trojan.hdog connectivity check-in version 2"

• "MALWARE-CNC Win.Trojan.PRISM variant outbound connection"

• "MALWARE-CNC Win.Trojan.Gupd variant outbound connection"

• "EXPLOIT-KIT Styx exploit kit plugin detection connection jovf"

• "MALWARE-CNC Win.Trojan.GateKeylogger keylog exfiltration attempt"

• "MALWARE-CNC Win.Trojan.TechSupportScam installed binary outbound connection"

• "MALWARE-CNC Win.Trojan.MSIL variant outbound connection"

• "MALWARE-CNC Win.Trojan.Upatre variant outbound connection"

• "INDICATOR-OBFUSCATION Javascript obfuscation - fromCharCode - seen in IFRAMEr Tool attack"

• "MALWARE-CNC Win.Trojan.BlackRev cnc exec command"

• "MALWARE-CNC Win.Trojan.Zbot variant outbound connection"

• "PUA-TOOLBARS Vittalia adware outbound connection - Eazel toolbar install"

• "MALWARE-CNC Win.Downloader.Zebrocy known malicious user-agent string"

• "MALWARE-CNC Win.Trojan.Dyre publickey outbound connection"

• "MALWARE-CNC User-Agent known malicious user agent - EMERY - Win.Trojan.W97M"

• "MALWARE-CNC Win.Backdoor.Aumlib variant outbound connection"

• "EXPLOIT-KIT Blackholev2 exploit kit landing page"

• "MALWARE-CNC User-Agent known malicious user-agent string - Treck - Win.Backdoor.Upatre"

• "MALWARE-CNC Win.Tinybanker variant outbound connection"

• "MALWARE-CNC Win.Trojan.ModularInstaller variant outbound connection detected"

• "MALWARE-CNC Win.Trojan.Poseidon outbound connection"

• "MALWARE-CNC User-Agent known malicious user-agent string Uploador - Win.Trojan.CrossRAT"

• "MALWARE-CNC Win.Trojan.Sodebral variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /index.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.Banload variant inbound connection"

• "MALWARE-CNC Win.Trojan.Dridex certificate exchange"

• "MALWARE-CNC Unix.Backdoor.Godlua variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection - MSIE7 No Referer No Cookie"

• "MALWARE-CNC User-Agent known malicious user-agent string fortis"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Win.Trojan.Tinba outbound connection"

• "MALWARE-CNC Win.Trojan.Badur download attempt"

• "MALWARE-CNC Win.Trojan.Boaxxe variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Agent Funeral ceremony phishing attempt"

• "MALWARE-CNC Win.Backdoor.NanoBot variant outbound connection"

• "MALWARE-TOOLS GhostPack Rubeus kerberos request attempt"

• "MALWARE-BACKDOOR Win.Trojan.Wiper inbound communication attempt"

• "MALWARE-CNC Cobalt Strike DNS beacon inbound TXT record"

• "MALWARE-CNC Vbs.Trojan.Agent inbound payload download"

• "MALWARE-CNC Win.Trojan.ZeroAccess outbound connection"

• "MALWARE-CNC Win.Trojan.Copperhedge outbound connection"

• "MALWARE-CNC Win.Downloader.TeamBot outbound cnc connection"

• "MALWARE-CNC Win.Trojan.yty module download request"

• "MALWARE-CNC ZoxPNG initial outbound connection"

• "MALWARE-CNC Vbs.Downloader.Agent inbound connection"

• "MALWARE-OTHER Win.Worm.Dorkbot Desktop.ini snkb0ptz.exe creation attempt SMB"

• "MALWARE-OTHER ANDR.Trojan.Agent outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Dyre publickey outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /login.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.Zbot/Bublik inbound connection"

• "MALWARE-CNC Osx.Trojan.Calisto outbound connection"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "FILE-PDF hostile PDF associated with Laik exploit kit"

• "MALWARE-CNC Win.Trojan.OnlineGameHack variant outbound connection"

• "MALWARE-CNC Win.Backdoor.Chopper web shell connection"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "INDICATOR-COMPROMISE All Numbers .EXE file name from abnormally ordered HTTP headers - Potential Yakes Trojan Download"

• "MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"

• "MALWARE-CNC Win.Backdoor.CSBundle_Original outbound connection attempt"

• "MALWARE-CNC Linux.Trojan.XORDDoS outbound connection"

• "MALWARE-CNC Win.Trojan.Buterat variant outbound connection"

• "MALWARE-CNC Yakes Trojan HTTP Header Structure"

• "MALWARE-CNC Win.Trojan.Qarallax outbound connection"

• "MALWARE-CNC Win.Backdoor.CSBundle_Original Server 3 inbound beacon attempt"

• "MALWARE-CNC Win.Trojan.Dridex self-signed certificate exchange"

• "MALWARE-OTHER Win.Worm.Dorkbot executable snkb0ptz.exe creation attempt SMB"

• "MALWARE-CNC Win.Trojan.TorrentLocker/Teerac payment page request"

• "MALWARE-CNC Win.Trojan.Androm variant outbound connection"

• "INDICATOR-COMPROMISE Apache auto_prepend_file a.control.bin C2 traffic"

• "MALWARE-CNC Win.Trojan.FakeAV variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /search.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.Zbot/Bublik outbound connection"

• "MALWARE-CNC Osx.Trojan.Calisto outbound connection"

• "MALWARE-CNC Win.Trojan.Gh0st variant outbound connection"

• "MALWARE-CNC Vbs.Trojan.Agent inbound payload download"

• "MALWARE-CNC Cobalt Strike DNS beacon inbound TXT record"

• "MALWARE-CNC Win.Trojan.Copperhedge outbound connection"

• "MALWARE-CNC Win.Trojan.yty module request"

• "MALWARE-CNC Win.Trojan.MadMax implant outbound connection attempt"

• "MALWARE-CNC Vbs.Downloader.Agent inbound delivery attempt"

• "MALWARE-BACKDOOR Win.Trojan.Wiper download attempt"

• "MALWARE-CNC XP Fake Antivirus Check-in"

• "MALWARE-CNC Win.Trojan.RedLeaves variant outbound connection"

• "MALWARE-TOOLS GhostPack Rubeus kerberos request attempt"

• "MALWARE-CNC Win.Trojan.Badur variant outbound connection"

• "MALWARE-BACKDOOR Cobalt Strike beacon connection attempt"

• "MALWARE-CNC Win.Trojan.SocketPlayer outbound connection"

• "MALWARE-OTHER Win.Trojan.Agent E-FAX phishing attempt"

• "EXPLOIT-KIT Nuclear exploit kit outbound structure"

• "MALWARE-CNC Win.Trojan.Dridex certificate exchange"

• "MALWARE-CNC Win.Trojan.AcridRain outbound connection"

• "MALWARE-CNC Win.Trojan.DesertFalcon variant outbound connection"

• "MALWARE-CNC Win.Zusy variant outbound connection"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /setup.htm GET Encrypted Payload"

• "MALWARE-TOOLS Win.Trojan.Wiper proxy tool download attempt"

• "MALWARE-CNC Win.Trojan.Heur variant outbound connection"

• "EXPLOIT-KIT Blackholev2/Cool exploit kit outbound portable executable request"

• "MALWARE-CNC Win.Trojan.Sodebral HTTP Response attempt"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Trojan.ModularInstaller variant outbound connection detected"

• "MALWARE-CNC Potential hostile executable served from compromised or malicious WordPress site attempt"

• "MALWARE-CNC Win.Backdoor.JRat inbound self-signed SSL certificate"

• "MALWARE-CNC User-Agent known malicious user-agent string - Install - Win.Backdoor.Upatre"

• "MALWARE-CNC Medfos Trojan variant outbound connection"

• "MALWARE-CNC Win.Backdoor.IsSpace initial outbound connection"

• "MALWARE-CNC Malicious BitCoiner Miner download - Win.Trojan.Systema"

• "MALWARE-CNC Win.Trojan.BlackRev cnc dns command"

• "MALWARE-BACKDOOR Win.Backdoor.Agent webshell inbound request attempt"

• "INDICATOR-COMPROMISE Potential malware download - _pdf.exe within .zip file"

• "PUA-TOOLBARS Vittalia adware outbound connection - offers"

• "MALWARE-CNC Win.Trojan.TechSupportScam installed binary outbound connection"

• "MALWARE-CNC Win.Trojan.Sweeper variant dropper initial download attempt"

• "INDICATOR-OBFUSCATION Javascript obfuscation - createElement - seen in IFRAMEr Tool attack"

• "MALWARE-CNC Win.Trojan.Prok variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bisonha variant outbound connection"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant send mail credentials"

• "MALWARE-CNC Win.Trojan.FileEncoder variant outbound connection"

• "MALWARE-CNC Win.Trojan.Yakes variant dropper"

• "MALWARE-CNC Win.Trojan.iSpy variant outbound connection"

• "MALWARE-CNC Win.Trojan.iSpySoft variant outbound connection"

• "MALWARE-CNC BLYPT installer startupkey outbound traffic"

• "MALWARE-CNC Fort Disco Registration variant outbound connection"

• "MALWARE-BACKDOOR DeepThroat 3.1 Connection attempt on port 4120"

• "MALWARE-CNC Vbs.Downloader.Kryptik known malicious user-agent string "

• "EXPLOIT-KIT Goon/Infinity exploit kit malicious portable executable file request"

• "MALWARE-CNC Win.Trojan.BlackRev cnc tcpdata command"

• "MALWARE-CNC Win.Trojan.Dridex file download attempt"

• "MALWARE-CNC Win.Trojan.Danabot outbound connection"

• "PUA-ADWARE Win.Adware.OpenSoftwareUpdater variant outbound connection attempt"

• "MALWARE-CNC Android.Trojan.SpyNote RAT variant inbound connection"

• "MALWARE-CNC Win.Trojan.Banload variant MSSQL response"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /file.htm GET Encrypted Payload"

• "MALWARE-BACKDOOR Win.Backdoor.Chopper webshell inbound request attempt"

• "MALWARE-CNC Win.Trojan.Banbra variant outbound connection"

• "MALWARE-CNC Win.Trojan.Dridex file download attempt"

• "MALWARE-CNC Unix.Trojan.Vpnfilter plugin variant connection attempt"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection - op POST"

• "MALWARE-CNC Win.Trojan.Autophyte RAT variant outbound connection"

• "MALWARE-CNC Win.Trojan.Kraens initial outbound request"

• "MALWARE-CNC Win.Trojan.DNSChanger variant outbound connection"

• "INDICATOR-COMPROMISE exe.exe download"

• "MALWARE-BACKDOOR Win.Trojan.Wiper download attempt"

• "MALWARE-CNC Win.Trojan.ZeroAccess URI and Referer"

• "MALWARE-CNC Brazilian Banking Trojan data theft"

• "MALWARE-CNC Win.Trojan.Fareit variant outbound connection - /main.htm GET Encrypted Payload"

• "MALWARE-CNC Win.Trojan.TeamBot outbound cnc connection"

• "MALWARE-CNC Win.Trojan.Silverstar outbound connection"

• "MALWARE-CNC Win.Trojan.Neuron variant inbound service request detected"

• "MALWARE-CNC Win.Trojan.Zeus outbound connection"

• "MALWARE-CNC Js.Trojan.Agent JS Sniffer beacon connection"

• "MALWARE-CNC Win.Dropper.Ch variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC MultiOS.Malware.GORAT outbound communication attempt"

• "MALWARE-CNC Win.Trojan.Blocker variant outbound connection POST"

• "MALWARE-CNC BLYPT installer createproc outbound traffic"

• "MALWARE-CNC Linux.Downloader.Mumblehard variant outbound connection"

• "MALWARE-CNC Win.Trojan.Betad variant outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-OTHER ANDR.Trojan.iBanking outbound connection attempt"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Win.Trojan.Foreign variant outbound connection - MSIE 7.1"

• "MALWARE-CNC Win.Trojan.Spyrat variant outbound connection"

• "MALWARE-CNC Win.Trojan.Symmi variant outbound connection"

• "MALWARE-OTHER Win.Ransomware.Satan payload download"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Worm.Neeris IRCbot variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper download attempt"

• "MALWARE-BACKDOOR SubSeven 2.1 Gold server connection response"

• "EXPLOIT-KIT HiMan exploit kit outbound payload retreival - specific string"

• "MALWARE-CNC Win.Trojan.Zegost variant outbound connection"

• "MALWARE-CNC Win.Rootkit.Necurs outbound connection"

• "MALWARE-CNC Win.Trojan.Bancos variant outbound connection"

• "MALWARE-CNC Win.Trojan.Chebri variant outbound connection"

• "MALWARE-CNC Win.Trojan.Darkhotel data upload attempt"

• "MALWARE-CNC Win.Trojan.Zeus variant outbound connection"

• "MALWARE-CNC Win.Trojan.Zbot variant in.php outbound connection"

• "MALWARE-CNC Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot"

• "MALWARE-CNC Win.Trojan.Silence variant outbound connection detected"

• "MALWARE-CNC Win.Banker.Delf variant outbound connection"

• "EXPLOIT-KIT Astrum exploit kit landing page"

• "MALWARE-CNC Win.Trojan.XpertRAT inbound connection"

• "MALWARE-CNC Osx.Trojan.WindTail outbound connection"

• "MALWARE-CNC Andr.Trojan.ZooPark outbound connection attempt"

• "MALWARE-BACKDOOR Perl.Backdoor.STEADYPULSE webshell variant access"

• "MALWARE-BACKDOOR Win.Backdoor.Hikit outbound banner response"

• "MALWARE-CNC Win.Trojan.Careto plugin download"

• "MALWARE-CNC Win.Trojan.NetWiredRC variant keepalive"

• "MALWARE-CNC User-Agent known malicious user agent - ALIZER"

• "MALWARE-CNC Win.Trojan.Jackpos outbound connection"

• "MALWARE-CNC Win.Trojan.Dropper inbound encrypted traffic"

• "MALWARE-CNC User-Agent known malicious user agent Opera 10"

• "POLICY-SPAM Potential phishing attack - .zip shipping filename download with .exe name within .zip the same "

• "MALWARE-CNC Win.Backdoor.DFSCook variant outbound connection"

• "MALWARE-OTHER Win.Trojan.Wiper listener download attempt"

• "INDICATOR-COMPROMISE Potential Redirect from Compromised WordPress site to Fedex - Spammed Malware Download attempt"

protocol-command-decode

• "SERVER-MYSQL 4.0 root login attempt"

• "OS-WINDOWS Microsoft Windows SMB Trans2 FIND_FIRST2 command response overflow attempt"

• "NETBIOS SMB NT Trans NT CREATE andx invalid SACL ace size dos attempt"

• "OS-WINDOWS DCERPC NCACN-IP-TCP ISystemActivator RemoteCreateInstance attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt"

• "SERVER-ORACLE all_tab_privs access"

• "NETBIOS SMB Trans2 OPEN2 unicode maximum param count overflow attempt"

• "POLICY-OTHER Microsoft Windows Terminal server RDP attempt"

• "NETBIOS SMB-DS Trans2 QUERY_FILE_INFO andx attempt"

• "SERVER-ORACLE create table attempt"

• "NETBIOS SMB-DS Trans2 Distributed File System GET_DFS_REFERRAL request"

• "OS-WINDOWS DCERPC NCADG-IP-UDP ISystemActivator CoGetInstanceFromFile attempt"

• "SERVER-ORACLE sys.all_users access"

• "NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt"

• "NETBIOS SMB NT Trans NT CREATE SACL overflow attempt"

• "NETBIOS SMB Trans2 QUERY_FILE_INFO attempt"

• "NETBIOS SMB NT Trans NT CREATE andx SACL overflow attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE andx SACL overflow attempt"

• "SERVER-MYSQL root login attempt"

• "PROTOCOL-RPC sadmind TCP PING"

• "SERVER-ORACLE user_tablespace access"

• "OS-WINDOWS DCERPC NCACN-IP-TCP ISystemActivator CoGetInstanceFromFile attempt"

• "SERVER-ORACLE drop table attempt"

• "NETBIOS SMB Session Setup andx username overflow attempt"

• "NETBIOS SMB Trans2 FIND_FIRST2 attempt"

• "SERVER-ORACLE all_tab_columns access"

• "NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"

• "NETBIOS SMB Trans2 FIND_FIRST2 find file and directory info request"

• "NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"

• "NETBIOS SMB-DS Trans2 FIND_FIRST2 andx attempt"

• "PROTOCOL-FTP CWD Root directory traversal attempt"

• "SERVER-MAIL expn cybercop attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode DACL overflow attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode oversized Security Descriptor attempt"

• "SERVER-ORACLE select union attempt"

• "OS-WINDOWS Microsoft Windows SMB-DS Trans2 FIND_FIRST2 response overflow attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode andx DACL overflow attempt"

• "SERVER-ORACLE all_tables access"

• "SERVER-ORACLE truncate table attempt"

• "SERVER-ORACLE alter table attempt"

• "PROTOCOL-VOIP inbound INVITE message"

• "SERVER-ORACLE all_source access"

• "NETBIOS DCERPC NCACN-IP-TCP winreg InitiateSystemShutdown attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode DACL overflow attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "OS-WINDOWS Microsoft Windows SMB Trans2 FIND_FIRST2 response andx overflow attempt"

• "SERVER-ORACLE select like '%' attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode andx oversized Security Descriptor attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode andx DACL overflow attempt"

• "SERVER-ORACLE connect_data remote version detection attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE oversized Security Descriptor attempt"

• "PROTOCOL-FTP invalid MODE"

• "NETBIOS SMB NT Trans NT CREATE DACL overflow attempt"

• "NETBIOS SMB NT Trans NT CREATE oversized Security Descriptor attempt"

• "SERVER-ORACLE select like '%' attempt backslash escaped"

• "NETBIOS SMB-DS Session Setup unicode andx username overflow attempt"

• "SERVER-ORACLE alter database attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE DACL overflow attempt"

• "SERVER-ORACLE all_views access"

• "PROTOCOL-FTP LIST directory traversal attempt"

• "NETBIOS SMB NT Trans NT CREATE andx invalid SACL ace size dos attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt"

• "OS-WINDOWS Microsoft Windows SMB-DS Trans2 FIND_FIRST2 response andx overflow attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"

• "NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"

• "SERVER-ORACLE all_constraints access"

• "NETBIOS SMB-DS NT Trans NT CREATE andx DACL overflow attempt"

• "PROTOCOL-NNTP return code buffer overflow attempt"

• "SERVER-ORACLE describe attempt"

• "SERVER-ORACLE create database attempt"

• "NETBIOS SMB NT Trans NT CREATE andx oversized Security Descriptor attempt"

• "SERVER-MAIL ehlo cybercop attempt"

• "POLICY-OTHER IPSec PGPNet connection attempt"

• "NETBIOS SMB NT Trans NT CREATE andx DACL overflow attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE andx oversized Security Descriptor attempt"

• "NETBIOS SMB-DS Session Setup andx username overflow attempt"

• "SERVER-ORACLE ALTER USER attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt"

• "OS-WINDOWS Microsoft Windows SMB Trans Max Param/Count OS-WINDOWS attempt"

• "SERVER-ORACLE dba_tables access"

• "PROTOCOL-RPC sadmind UDP PING"

• "NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"

• "NETBIOS DCERPC NCACN-IP-TCP srvsvc NetrShareEnum null policy handle attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"

• "NETBIOS SMB TRANS2 Find_First2 request attempt"

• "NETBIOS SMB-DS Trans2 FIND_FIRST2 attempt"

• "NETBIOS SMB Trans2 QUERY_FILE_INFO andx attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode oversized Security Descriptor attempt"

• "PROTOCOL-FTP SYST overflow attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode SACL overflow attempt"

• "SERVER-MYSQL show databases attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"

• "NETBIOS SMB-DS ADMIN$ share access"

• "OS-WINDOWS DCERPC NCADG-IP-UDP ISystemActivator RemoteCreateInstance attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode andx SACL overflow attempt"

• "PROTOCOL-FTP PWD overflow attempt"

• "NETBIOS SMB-DS NT Trans NT CREATE unicode andx oversized Security Descriptor attempt"

• "POLICY-OTHER Microsoft Windows Terminal server request attempt"

• "NETBIOS SMB-DS Trans2 QUERY_FILE_INFO attempt"

• "NETBIOS SMB Trans2 FIND_FIRST2 andx attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"

• "SERVER-ORACLE dba_tablespace access"

• "NETBIOS SMB NT Trans NT CREATE unicode andx SACL overflow attempt"

• "NETBIOS SMB Session Setup unicode username overflow attempt"

• "SERVER-ORACLE grant attempt"

attempted-recon

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "PROTOCOL-SCADA PCOM Write System Longs ASCII request "

• "SERVER-WEBAPP pals-cgi access"

• "OS-WINDOWS Microsoft Windows SMB NTLM NULL session attempt"

• "PROTOCOL-SCADA PCOM Write System Integers ASCII request "

• "SERVER-WEBAPP Domino webadmin.nsf access"

• "SERVER-WEBAPP .htaccess access"

• "SERVER-WEBAPP w3tvars.pm access"

• "INDICATOR-COMPROMISE Invalid URL"

• "SERVER-WEBAPP Domino events4.nsf access"

• "SERVER-WEBAPP archie access"

• "SERVER-WEBAPP filemail access"

• "MALWARE-BACKDOOR hack-a-tack attempt"

• "SERVER-WEBAPP System variable directory traversal attempt - %PROGRAMDATA%"

• "SERVER-WEBAPP mall log order access"

• "SERVER-WEBAPP finger access"

• "PROTOCOL-SCADA PCOM Read Data Table binary request"

• "SERVER-WEBAPP aglimpse access"

• "SERVER-OTHER Adobe Coldfusion addcontent.cfm access"

• "SERVER-WEBAPP websendmail access"

• "SERVER-WEBAPP System variable directory traversal attempt - %USERPROFILE%"

• "SERVER-WEBAPP carbo.dll access"

• "SERVER-WEBAPP NPH-maillist access"

• "SERVER-WEBAPP Domino domlog.nsf access"

• "SERVER-WEBAPP System variable directory traversal attempt - %COMSPEC%"

• "SERVER-WEBAPP classifieds.cgi access"

• "SERVER-WEBAPP BigBrother access"

• "SERVER-OTHER Adobe Coldfusion exprcalc access"

• "SERVER-WEBAPP dcboard.cgi access"

• "SERVER-MAIL Sendmail expn decode"

• "SERVER-WEBAPP Netgear WNR2000 information disclosure attempt"

• "SERVER-WEBAPP cvsweb.cgi access"

• "SERVER-OTHER Adobe Coldfusion cfmlsyntaxcheck.cfm access"

• "SERVER-WEBAPP webcart access"

• "SERVER-WEBAPP Domino mab.nsf access"

• "SERVER-WEBAPP /etc/inetd.conf file access attempt"

• "PROTOCOL-SCADA PCOM Read Memory Bits ASCII request "

• "PROTOCOL-ICMP superscan echo"

• "SERVER-WEBAPP System variable in URI attempt - %PATHEXT%"

• "SERVER-WEBAPP Oracle Application Server 9i unauthenticated application deployment attempt"

• "INDICATOR-SCAN cybercop os probe"

• "SERVER-WEBAPP csh access"

• "PROTOCOL-SCADA PCOM Read System Bits ASCII reply"

• "SERVER-WEBAPP sendmessage.cgi access"

• "SERVER-WEBAPP mailnews.cgi access"

• "SERVER-WEBAPP test-cgi access"

• "SERVER-WEBAPP shopping cart access"

• "X11 xdmcp info query"

• "PROTOCOL-FINGER account enumeration attempt"

• "SERVER-OTHER OpenSSL SSLv3 heartbeat read overrun attempt"

• "INDICATOR-SCAN Amanda client-version request"

• "PROTOCOL-VOIP Possible SIP OPTIONS service information gathering attempt"

• "SERVER-WEBAPP Ecommerce import.txt access"

• "SERVER-WEBAPP mmstdod.cgi access"

• "PROTOCOL-FTP REST with numeric argument"

• "SERVER-WEBAPP System variable in URI attempt - %COMPUTERNAME%"

• "SERVER-WEBAPP Netgear WNR2000 information leak attempt"

• "PROTOCOL-SCADA PCOM Read Memory Bits ASCII reply"

• "INDICATOR-SCAN ipEye SYN scan"

• "SERVER-WEBAPP ultraboard access"

• "SERVER-OTHER OpenSSL SSLv3 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-WEBAPP ROXEN directory list attempt"

• "SERVER-WEBAPP filemail access"

• "SERVER-OTHER OpenSSL TLSv1.2 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-APACHE Apache Tomcat server snoop access"

• "SERVER-WEBAPP man.sh access"

• "PROTOCOL-SCADA PCOM Read Memory Integers ASCII reply"

• "PROTOCOL-VOIP Ghost call attack attempt"

• "SERVER-WEBAPP dcforum.cgi access"

• "SERVER-WEBAPP System variable directory traversal attempt - %PSModulePath%"

• "POLICY-OTHER TrendMicro ServerProtect server configuration file download detected"

• "SERVER-OTHER OpenSSL TLSv1 heartbeat read overrun attempt"

• "SERVER-WEBAPP listrec.pl access"

• "SERVER-WEBAPP rwwwshell.pl access"

• "SERVER-WEBAPP Novell Groupwise gwweb.exe access"

• "PROTOCOL-SCADA PCOM Read Longs ASCII reply"

• "OS-WINDOWS Microsoft Windows SMB anonymous session IPC share access attempt"

• "SERVER-WEBAPP zsh access"

• "SERVER-WEBAPP System variable in URI attempt - %PROMPT%"

• "SERVER-WEBAPP /ws_ftp.log file access attempt"

• "OS-WINDOWS NT NULL session"

• "SERVER-WEBAPP Netscape Unixware overflow"

• "SERVER-WEBAPP day5datacopier.cgi access"

• "INDICATOR-SCAN cybercop os probe"

• "SERVER-OTHER Adobe Coldfusion snippets attempt"

• "SERVER-WEBAPP win-c-sample.exe access"

• "SERVER-WEBAPP Ecommerce check.txt access"

• "PROTOCOL-SCADA PCOM Write Ouputs ASCII request "

• "SERVER-WEBAPP /cgi-bin/sh file access attempt"

• "OS-WINDOWS Microsoft Windows SMB kernel heap memory leak attempt"

• "SERVER-WEBAPP architext_query.pl access"

• "SERVER-OTHER OpenSSL TLSv1.2 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-OTHER Adobe Coldfusion fileexists.cfm access"

• "PROTOCOL-SNMP public access udp"

• "SERVER-WEBAPP Domino log.nsf access"

• "SERVER-MAIL vrfy root"

• "SERVER-WEBAPP System variable directory traversal attempt - %COMMONPROGRAMFILES - x86%"

• "SERVER-WEBAPP root access"

• "SERVER-WEBAPP System variable directory traversal attempt - %USERNAME%"

• "SERVER-WEBAPP anform2 access"

• "SERVER-OTHER Adobe Coldfusion getfile.cfm access"

• "PROTOCOL-SCADA PCOM Get PLC Name binary request"

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "OS-WINDOWS Microsoft Windows SMB NTLM NULL session attempt"

• "SERVER-WEBAPP System variable directory traversal attempt - %ALLUSERSPROFILE%"

• "SERVER-WEBAPP webgais access"

• "SERVER-WEBAPP plusmail access"

• "SERVER-WEBAPP Domino ntsync4.nsf access"

• "SERVER-WEBAPP LWGate access"

• "INDICATOR-COMPROMISE 403 Forbidden"

• "PROTOCOL-SCADA PCOM Write System Bits ASCII request "

• "SERVER-WEBAPP Domino statrep.nsf access"

• "SERVER-WEBAPP cpshost.dll access"

• "SERVER-WEBAPP admin.pl access"

• "SERVER-OTHER Cisco IOS Group-Prime SHA memory disclosure attempt"

• "PROTOCOL-SCADA PCOM Get RTC ASCII request "

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "PROTOCOL-DNS TCP inverse query"

• "PROTOCOL-SCADA PCOM Read Operands binary request"

• "PROTOCOL-RPC mountd UDP unmount request"

• "SERVER-WEBAPP Netgear WNR2000 information disclosure attempt"

• "SERVER-WEBAPP bb-rep.sh access"

• "SERVER-WEBAPP glimpse access"

• "SERVER-WEBAPP Oracle WebLogic Server potential unauthenticated reconnaissance attempt"

• "SERVER-WEBAPP ?PageServices access"

• "SERVER-WEBAPP tcsh access"

• "PROTOCOL-OTHER TP-Link TDDP Get_config configuration leak attempt"

• "SERVER-WEBAPP System variable in URI attempt - %USERDOMAIN%"

• "PROTOCOL-SNMP trap tcp"

• "SERVER-WEBAPP day5datanotifier.cgi access"

• "PROTOCOL-SCADA PCOM Read Inputs ASCII request "

• "PROTOCOL-RPC mountd UDP export request"

• "SERVER-WEBAPP cart 32 AdminPwd access"

• "SERVER-WEBAPP rguest.exe access"

• "SERVER-WEBAPP sadmind worm access"

• "SERVER-WEBAPP VirusWall FtpSave access"

• "SERVER-OTHER OpenSSL TLSv1.1 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-WEBAPP mlog.phtml access"

• "SERVER-WEBAPP yabb access"

• "PROTOCOL-SCADA PCOM Write Data Table binary reply"

• "PROTOCOL-VOIP Excessive number of SIP 4xx responses potential user or password guessing attempt"

• "PROTOCOL-SCADA PCOM Write Memory Bits ASCII reply"

• "SERVER-WEBAPP windmail.exe access"

• "SERVER-WEBAPP System variable directory traversal attempt - %SystemDrive%"

• "PROTOCOL-FINGER cybercop query"

• "SERVER-OTHER OpenSSL TLSv1.2 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-WEBAPP Phorum code access"

• "SERVER-WEBAPP Phorum read access"

• "SERVER-WEBAPP nph-test-cgi access"

• "SERVER-WEBAPP view_source access"

• "PROTOCOL-SCADA PCOM Write Memory Bits ASCII request "

• "SERVER-WEBAPP upload.pl access"

• "PROTOCOL-SCADA PCOM Read Memory Integers ASCII request "

• "SERVER-OTHER OpenSSL SSLv3 heartbeat read overrun attempt - vulnerable client response"

• "SERVER-WEBAPP Domino mail.box access"

• "SERVER-WEBAPP www-sql access"

• "PROTOCOL-SCADA PCOM Identification ASCII request "

• "SERVER-WEBAPP whisker HEAD/./"

• "SERVER-WEBAPP rsh access"

• "PROTOCOL-RPC rusers query UDP"

• "PROTOCOL-SCADA PCOM Write Data Table binary request"

• "SERVER-WEBAPP console.exe access"

• "SERVER-WEBAPP args.bat access"

• "X11 xdmcp query"

• "SERVER-WEBAPP webspirs.cgi access"

• "SERVER-WEBAPP /.... access"

• "SERVER-WEBAPP user_update_admin.pl access"

• "SERVER-WEBAPP System variable directory traversal attempt - %USERDATA%"

• "SERVER-WEBAPP Domino names.nsf access"

• "SERVER-WEBAPP System variable directory traversal attempt - %HOMEPATH%"

• "PROTOCOL-SCADA PCOM Write Memory Integers ASCII reply"

• "PROTOCOL-ICMP traceroute"

• "SERVER-WEBAPP wguest.exe access"

• "PROTOCOL-SNMP broadcast trap"

• "SERVER-WEBAPP Trend Micro OfficeScan attempt"

• "SERVER-WEBAPP wrap access"

• "PROTOCOL-SNMP request udp"

• "PROTOCOL-SCADA PCOM Write Longs ASCII reply"

• "SERVER-WEBAPP Ecommerce checks.txt access"

• "SERVER-WEBAPP System variable directory traversal attempt - %HOMEDRIVE%"

• "SERVER-WEBAPP webplus version access"

• "SERVER-WEBAPP calender_admin.pl access"

• "SERVER-WEBAPP System variable directory traversal attempt - %TMP%"

• "SERVER-WEBAPP AT-admin.cgi access"

• "PROTOCOL-SNMP NT UserList"

• "PROTOCOL-RPC mountd UDP mount request"

• "SERVER-OTHER OpenSSL SSLv3 large heartbeat response - possible ssl heartbleed attempt"

• "PROTOCOL-DNS named version attempt"

• "PROTOCOL-SCADA PCOM Get UnitID ASCII reply"

• "SERVER-WEBAPP cs.exe access"

• "SERVER-WEBAPP get32.exe access"

• "INDICATOR-SCAN myscan"

• "SERVER-WEBAPP dumpenv.pl access"

• "SERVER-OTHER OpenSSL TLSv1 heartbeat read overrun attempt - vulnerable client response"

• "PROTOCOL-DNS dns zone transfer via TCP detected"

• "SERVER-WEBAPP sendform.cgi access"

• "PROTOCOL-SCADA PCOM Read Memory Longs ASCII request "

• "SERVER-WEBAPP Phorum violation access"

• "PROTOCOL-VOIP Possible SIP OPTIONS service information gathering attempt"

• "SERVER-WEBAPP maillist.pl access"

• "SERVER-OTHER OpenSSL TLSv1.1 large heartbeat response - possible ssl heartbleed attempt"

• "PROTOCOL-DNS dns zone transfer via UDP detected"

• "PROTOCOL-FINGER redirection attempt"

• "SERVER-WEBAPP webplus access"

• "SERVER-WEBAPP webdriver access"

• "SERVER-WEBAPP System variable directory traversal attempt - %PROGRAMFILES - X86%"

• "SERVER-MAIL vrfy decode"

• "PROTOCOL-SCADA PCOM Write System Integers ASCII reply"

• "PROTOCOL-SCADA PCOM Read Data Table binary reply"

• "SERVER-WEBAPP ls 20-l"

• "SERVER-WEBAPP view-source access"

• "SERVER-WEBAPP VirusWall catinfo access"

• "SERVER-OTHER OpenSSL TLSv1.2 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-WEBAPP sdbsearch.cgi access"

• "PROTOCOL-RPC mountd TCP exportall request"

• "SERVER-WEBAPP perl.exe access"

• "PROTOCOL-SNMP AgentX/tcp request"

• "SERVER-WEBAPP ksh access"

• "SERVER-WEBAPP Phorum admin access"

• "PROTOCOL-SCADA PCOM Set RTC ASCII request "

• "SERVER-WEBAPP Orange LiveBox unauthorized credentials access attempt"

• "SERVER-WEBAPP Oracle WebLogic Server unauthenticated modified JSP access attempt"

• "SERVER-OTHER Adobe Coldfusion gettempdirectory.cfm access "

• "PROTOCOL-ICMP ISS Pinger"

• "SERVER-WEBAPP /etc/passwd file access attempt"

• "SERVER-WEBAPP commerce.cgi arbitrary file access attempt"

• "SERVER-WEBAPP bb-histsvc.sh access"

• "SERVER-WEBAPP php.cgi access"

• "SERVER-WEBAPP wwwboard.pl access"

• "PROTOCOL-SCADA PCOM Set UnitID ASCII reply"

• "PROTOCOL-RPC mountd TCP unmount request"

• "SERVER-WEBAPP Netgear WNR2000 information disclosure attempt"

• "PROTOCOL-SNMP request tcp"

• "SERVER-OTHER OpenSSL TLSv1.1 large heartbeat response - possible ssl heartbleed attempt"

• "INDICATOR-SCAN cybercop os PA12 attempt"

• "SERVER-WEBAPP ROADS search.pl attempt"

• "PROTOCOL-FINGER . query"

• "SERVER-WEBAPP Netgear passwordrecovered.cgi insecure admin password disclosure attempt"

• "PROTOCOL-SCADA PCOM Write System Bits ASCII reply"

• "SERVER-WEBAPP bb-histlog.sh access"

• "PROTOCOL-SCADA PCOM Read Operands binary reply"

• "PROTOCOL-RPC mountd UDP dump request"

• "SERVER-OTHER OpenSSL SSLv3 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-WEBAPP /~ftp access"

• "SERVER-OTHER OpenSSL SSLv3 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-WEBAPP VirusWall catinfo access"

• "INDICATOR-SCAN synscan portscan"

• "SERVER-WEBAPP Netscape dir index wp"

• "PROTOCOL-RPC mountd UDP exportall request"

• "SERVER-WEBAPP mailit.pl access"

• "NETBIOS SMB CD..."

• "SERVER-WEBAPP post-query access"

• "SERVER-WEBAPP Phorum authentication access"

• "SERVER-WEBAPP ppdscgi.exe access"

• "SERVER-WEBAPP snorkerz.cmd access"

• "PROTOCOL-ICMP L3retriever Ping"

• "PROTOCOL-RPC mountd TCP export request"

• "SERVER-WEBAPP info2www access"

• "PROTOCOL-RPC mountd UDP unmountall request"

• "SERVER-OTHER Adobe Coldfusion evaluate.cfm access"

• "PROTOCOL-SNMP private access tcp"

• "SERVER-WEBAPP wais.pl access"

• "POLICY-OTHER Teleopti WFM database information request detected"

• "SERVER-WEBAPP System variable directory traversal attempt - %PROGRAMFILES%"

• "SERVER-WEBAPP /wwwboard/passwd.txt access"

• "SERVER-WEBAPP System variable directory traversal attempt - %TEMP%"

• "SERVER-WEBAPP calendar.pl access"

• "SERVER-WEBAPP guestbook.pl access"

• "SERVER-WEBAPP websitepro path access"

• "SERVER-OTHER Adobe Coldfusion cfcache.map access"

• "PROTOCOL-RPC mountd TCP mount request"

• "SERVER-WEBAPP bnbform.cgi access"

• "SERVER-WEBAPP Lotus EditDoc attempt"

• "PROTOCOL-SCADA PCOM Get RTC ASCII reply"

• "PROTOCOL-FINGER / execution attempt"

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "SERVER-WEBAPP Admin_files access"

• "PROTOCOL-SCADA PCOM Set UnitID ASCII request "

• "SERVER-WEBAPP Domino bookmark.nsf access"

• "PROTOCOL-DNS named authors attempt"

• "SERVER-OTHER OpenSSL TLSv1.1 heartbeat read overrun attempt - vulnerable client response"

• "PROTOCOL-SCADA PCOM Read Ouputs ASCII request "

• "PROTOCOL-SCADA PCOM Write Memory Longs ASCII request "

• "SERVER-WEBAPP ttawebtop.cgi access"

• "SERVER-WEBAPP upload.cgi access"

• "SERVER-OTHER Arkeia client backup system info probe"

• "PROTOCOL-SCADA PCOM Write Memory Integers ASCII request "

• "PROTOCOL-SCADA PCOM Read System Bits ASCII request "

• "SERVER-WEBAPP AnyForm2 access"

• "SERVER-WEBAPP Oracle WebLogic Server potential precursor to keystore attack attempt"

• "PROTOCOL-DNS named version attempt"

• "SERVER-OTHER OpenSSL TLSv1.2 heartbeat read overrun attempt - vulnerable client response"

• "PROTOCOL-SCADA PCOM Get UnitID ASCII request "

• "SERVER-WEBAPP Domino agentrunner.nsf access"

• "SERVER-WEBAPP backup access"

• "SERVER-WEBAPP admin.php access"

• "PROTOCOL-SCADA PCOM Identification ASCII reply"

• "SERVER-WEBAPP Novell Groupwise gwweb.exe attempt"

• "SERVER-WEBAPP tstisapi.dll access"

• "SERVER-WEBAPP campas access"

• "SERVER-WEBAPP Lotus DelDoc attempt"

• "SERVER-WEBAPP System variable directory traversal attempt - %SystemRoot%"

• "SERVER-WEBAPP wwwwais access"

• "SERVER-WEBAPP whois_raw.cgi access"

• "SERVER-WEBAPP System variable directory traversal attempt - %LOCALAPPDATA%"

• "SERVER-WEBAPP yabb directory traversal attempt"

• "POLICY-OTHER Teleopti WFM administrative user credentials request detected"

• "SERVER-OTHER Adobe Coldfusion beaninfo access"

• "PROTOCOL-SNMP Broadcast request"

• "SERVER-WEBAPP files.pl access"

• "PROTOCOL-RPC mountd TCP unmountall request"

• "PROTOCOL-DNS UDP inverse query"

• "SERVER-WEBAPP htmlscript access"

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "SERVER-WEBAPP bb-replog.sh access"

• "SERVER-OTHER Adobe Coldfusion sendmail.cfm access"

• "SERVER-WEBAPP .nsconfig access"

• "SERVER-WEBAPP mylog.phtml access"

• "SERVER-WEBAPP survey.cgi access"

• "PROTOCOL-ICMP Nemesis v1.1 Echo"

• "PROTOCOL-DNS named authors attempt"

• "NETBIOS SMB CD.."

• "SERVER-WEBAPP visadmin.exe access"

• "SERVER-WEBAPP cd.."

• "SERVER-WEBAPP wwwadmin.pl access"

• "SERVER-WEBAPP piranha passwd.php3 access"

• "SERVER-OTHER OpenSSL TLSv1 large heartbeat response - possible ssl heartbleed attempt"

• "PROTOCOL-FINGER null request"

• "SERVER-OTHER OpenSSL TLSv1 large heartbeat response - possible ssl heartbleed attempt"

• "PROTOCOL-SCADA PCOM Get PLC Name binary reply"

• "PROTOCOL-RPC mountd TCP dump request"

• "SERVER-WEBAPP user_update_passwd.pl access"

• "SERVER-WEBAPP Joomla Proclaim biblestudy backup access attempt"

• "PROTOCOL-SCADA PCOM Write Ouputs ASCII reply"

• "INDICATOR-SCAN cybercop os SFU12 probe"

• "PROTOCOL-FINGER 0 query"

• "PROTOCOL-SNMP trap udp"

• "SERVER-WEBAPP BugPort config.conf file access"

• "SERVER-OTHER OpenSSL TLSv1 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-OTHER Adobe Coldfusion cfappman access"

• "PROTOCOL-SNMP public access tcp"

• "SERVER-WEBAPP environ.cgi access"

• "SERVER-WEBAPP System variable directory traversal attempt - %COMMONPROGRAMFILES%"

• "SERVER-WEBAPP Domino catalog.nsf access"

• "SERVER-OTHER OpenSSL Heartbleed masscan access exploitation attempt"

• "SERVER-WEBAPP AT-generated.cgi access"

• "SERVER-WEBAPP System variable directory traversal attempt - %PUBLIC%"

• "SERVER-WEBAPP Ecommerce import.txt access"

• "SERVER-WEBAPP lastlines.cgi access"

• "SERVER-OTHER Adobe Coldfusion application.cfm access"

• "PROTOCOL-FINGER version query"

• "SERVER-APACHE Apache Tomcat server exploit access"

• "SERVER-WEBAPP perlshop.cgi access"

• "PROTOCOL-SCADA PCOM Set RTC ASCII reply"

• "INDICATOR-SCAN ident version request"

• "SERVER-WEBAPP intranet access"

• "SERVER-WEBAPP Domino collect4.nsf access"

• "SERVER-WEBAPP flexform access"

• "SERVER-WEBAPP search.vts access"

• "SERVER-OTHER OpenSSL TLSv1.1 heartbeat read overrun attempt"

• "OS-WINDOWS Microsoft Windows SMB kernel heap memory leak attempt"

• "SERVER-WEBAPP /etc/shadow file access attempt"

• "PROTOCOL-SCADA PCOM Read System Longs ASCII request "

• "SERVER-WEBAPP redirect access"

• "SERVER-OTHER Cisco IOS Group-Prime MD5 memory disclosure attempt"

• "SERVER-WEBAPP Web Shopper shopper.cgi access"

• "SERVER-OTHER Arkeia client backup generic info probe"

• "SERVER-OTHER OpenSSL TLSv1.1 large heartbeat response - possible ssl heartbleed attempt"

• "PROTOCOL-SCADA PCOM Read System Integers ASCII reply"

• "PROTOCOL-VOIP Excessive number of SIP 4xx responses potential user or password guessing attempt"

• "SERVER-WEBAPP VirusWall FtpSaveCSP access"

• "SERVER-OTHER OpenSSL TLSv1.1 heartbeat read overrun attempt"

• "OS-WINDOWS Microsoft Windows SMB large NT RENAME transaction request memory leak attempt"

• "PROTOCOL-FINGER root query"

• "SERVER-WEBAPP uploader.exe access"

• "SERVER-WEBAPP ws_ftp.ini access"

• "SERVER-WEBAPP newsdesk.cgi access"

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "OS-WINDOWS Microsoft Windows SMB startup folder access"

• "SERVER-WEBAPP .wwwacl access"

• "SERVER-WEBAPP snork.bat access"

• "PROTOCOL-ICMP webtrends scanner"

• "SERVER-WEBAPP System variable in URI attempt - %LOGONSERVER%"

• "SERVER-OTHER Adobe Coldfusion mainframeset access"

• "SERVER-WEBAPP adminlogin access"

• "SERVER-WEBAPP perl.exe command attempt"

• "SERVER-WEBAPP /.svn/entries file access attempt"

• "SERVER-WEBAPP convert.bas access"

• "SERVER-WEBAPP Domino setup.nsf access"

• "SERVER-OTHER Adobe Coldfusion onrequestend.cfm access"

• "SERVER-WEBAPP SWEditServlet access"

• "SERVER-WEBAPP rksh access"

• "SERVER-WEBAPP AuthChangeUrl access"

• "SERVER-WEBAPP Domino cersvr.nsf access"

• "SERVER-OTHER Adobe Coldfusion application.cfm access"

• "SERVER-WEBAPP commerce.cgi access"

• "SERVER-WEBAPP perl command attempt"

• "SERVER-WEBAPP .wwwacl access"

• "SERVER-WEBAPP w3-msql access"

• "SERVER-WEBAPP System variable in URI attempt - %PATH%"

• "OS-WINDOWS Microsoft Windows SMB startup folder unicode access"

• "SERVER-WEBAPP textcounter.pl access"

• "SERVER-WEBAPP rpm_query access"

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "INDICATOR-SCAN Webtrends Scanner UDP Probe"

• "SERVER-WEBAPP VirusWall FtpSaveCVP access"

• "SERVER-OTHER OpenSSL TLSv1.2 heartbeat read overrun attempt"

• "OS-WINDOWS Microsoft Windows SMB possible leak of kernel heap memory"

• "PROTOCOL-FINGER search query"

• "SERVER-OTHER Adobe Coldfusion administrator access"

• "SERVER-MAIL expn root"

• "PROTOCOL-VOIP Ghost call attack attempt"

• "PROTOCOL-SCADA PCOM Read Ouputs ASCII reply"

• "SERVER-OTHER OpenSSL TLSv1 large heartbeat response - possible ssl heartbleed attempt"

• "SERVER-WEBAPP Trend Micro OfficeScan access"

• "SERVER-OTHER Cisco IOS Group-Prime memory disclosure exfiltration attempt"

• "PROTOCOL-SCADA PCOM Read System Integers ASCII request "

• "SERVER-WEBAPP /etc/motd file access attempt"

• "SERVER-WEBAPP bb-hist.sh access"

• "SERVER-OTHER OpenSSL TLSv1.2 heartbeat read overrun attempt"

• "SERVER-WEBAPP nessus 2.x 404 probe"

• "SERVER-WEBAPP Domino mailw46.nsf access"

• "SERVER-OTHER Adobe Coldfusion exampleapp access"

• "SERVER-WEBAPP calendar access"

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "PROTOCOL-SCADA PCOM Read Inputs ASCII reply"

• "SERVER-OTHER Adobe Coldfusion exampleapp application.cfm"

• "SERVER-WEBAPP apache source.asp file access"

• "OS-WINDOWS RFParalyze Attempt"

• "SERVER-WEBAPP args.cmd access"

• "SERVER-WEBAPP System variable directory traversal attempt - %WINDIR%"

• "SERVER-WEBAPP cat_ access"

• "SERVER-WEBAPP System variable directory traversal attempt - %APPDATA%"

• "SERVER-WEBAPP Domino domcfg.nsf access"

• "SERVER-OTHER Adobe Coldfusion parks access"

• "PROTOCOL-SNMP private access udp"

attempted-dos

• "SERVER-OTHER Winnuke attack"

• "MALWARE-OTHER mstream handler to agent"

• "PROTOCOL-FTP EXPLOIT STAT ? dos attempt"

• "PROTOCOL-ICMP Stacheldraht client check skillz"

• "MALWARE-OTHER mstream handler to client"

• "MALWARE-OTHER Trin00 Attacker to Master default startup password"

• "PROTOCOL-ICMP Stacheldraht gag server response"

• "OS-WINDOWS Microsoft WIndows IGMP dos attack"

• "PROTOCOL-ICMP Stacheldraht server spoof"

• "PROTOCOL-FTP RMD / attempt"

• "MALWARE-OTHER Trin00 Daemon to Master HELLO message detected"

• "SERVER-MAIL Microsoft Windows Exchange Server 5.5 mime DOS"

• "PROTOCOL-ICMP TFN client command BE"

• "MALWARE-OTHER mstream handler ping to agent"

• "MALWARE-OTHER Trin00 Attacker to Master default mdie password"

• "MALWARE-OTHER Trin00 Daemon to Master PONG message detected"

• "PROTOCOL-ICMP ath"

• "PROTOCOL-DNS DNS query amplification attempt"

• "SERVER-WEBAPP Annex Terminal DOS attempt"

• "NETBIOS SMB DCERPC invalid bind attempt"

• "SERVER-WEBAPP ICQ webserver DOS"

• "SERVER-IIS NTLM ASN1 vulnerability scan attempt"

• "SERVER-OTHER Ascend Route"

• "MALWARE-OTHER shaft handler to agent"

• "SERVER-OTHER RealNetworks Server template.html"

• "SERVER-OTHER Bay/Nortel Nautica Marlin"

• "PROTOCOL-ICMP TFN server response"

• "NETBIOS DCERPC invalid bind attempt"

• "MALWARE-OTHER mstream agent to handler"

• "PROTOCOL-SCADA PCOM Init Device ASCII request "

• "PROTOCOL-SCADA PCOM Reset Device ASCII request "

• "PROTOCOL-ICMP tfn2k icmp possible communication"

• "MALWARE-OTHER Trin00 Attacker to Master default password"

• "SERVER-OTHER RealNetworks Audio Server denial of service attempt"

• "PROTOCOL-ICMP TFN Probe"

• "MALWARE-OTHER Trin00 Master to Daemon default password attempt"

• "SERVER-WEBAPP apache directory disclosure attempt"

• "SERVER-OTHER ISAKMP invalid identification payload attempt"

• "MALWARE-OTHER shaft agent to handler"

• "SERVER-SAMBA Microsoft Windows SMBv2/SMBv3 Buffer Overflow attempt"

• "PROTOCOL-FINGER bomb attempt"

• "SERVER-OTHER multiple products blacknurse ICMP denial of service attempt"

• "PROTOCOL-ICMP Stacheldraht client check gag"

• "SERVER-OTHER SSDP M-SEARCH ssdp-all potential amplified distributed denial-of-service attempt"

• "SERVER-OTHER RealNetworks Server template.html"

• "OS-WINDOWS Microsoft Windows TCP print service overflow attempt"

• "MALWARE-OTHER mstream agent pong to handler"

• "MALWARE-OTHER mstream handler to client"

• "PROTOCOL-SCADA PCOM Stop Device ASCII request "

• "PROTOCOL-ICMP Stacheldraht client spoofworks"

• "MALWARE-OTHER Trin00 Daemon to Master message detected"

• "SERVER-OTHER MSDTC attempt"

• "POLICY-OTHER Microsoft Windows Terminal Server no encryption session initiation attempt"

• "PROTOCOL-RPC DOS ttdbserv Solaris"

• "PROTOCOL-FTP SITE NEWER attempt"

• "MALWARE-OTHER shaft client login to handler"

• "PROTOCOL-FTP EXPLOIT STAT asterisk dos attempt"

• "PROTOCOL-ICMP Stacheldraht server response"

• "PROTOCOL-TELNET livingston DOS"

• "PROTOCOL-SCADA PCOM Start Device ASCII request "

• "PROTOCOL-ICMP - TFN client command LE"

• "MALWARE-OTHER mstream client to handler"

policy-violation

• "PUA-P2P BitTorrent transfer"

• "OS-OTHER Nintendo User-Agent detected"

• "POLICY-SOCIAL Yahoo IM conference watch"

• "MALWARE-OTHER self-signed SSL certificate with default MyCompany Ltd organization name"

• "POLICY-SOCIAL Yahoo IM conference request"

• "POLICY-OTHER Chunked-Encoding transfer with no data attempt"

• "POLICY-SOCIAL Yahoo Messenger File Transfer Receive Request"

• "POLICY-OTHER Cisco Webex explicit use of web plugin detected"

• "OS-MOBILE Kindle User-Agent detected"

• "PUA-P2P eDonkey server response"

• "PUA-P2P BitTorrent announce request"

• "SERVER-WEBAPP MikroTik RouterOS cross site request forgery attempt"

• "POLICY-MULTIMEDIA Apple Quicktime User Agent access"

• "OS-WINDOWS Microsoft Windows empty RDP cookie negotiation attempt"

• "PUA-OTHER Bitcoin Mining extranonce Stratum protocol subscribe client request attempt"

• "APP-DETECT distccd remote command execution attempt"

• "OS-MOBILE Apple iPad User-Agent detected"

• "POLICY-SOCIAL Microsoft MSN outbound file transfer request"

• "POLICY-SOCIAL Microsoft MSN user search"

• "POLICY-SOCIAL IRC DCC chat request"

• "POLICY-SOCIAL IRC channel join"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router remote telnet enable attempt"

• "OS-MOBILE Samsung User-Agent detected"

• "PUA-P2P Outbound GNUTella client request"

• "POLICY-SOCIAL Yahoo IM voicechat"

• "POLICY-OTHER Java User-Agent remote class download attempt"

• "POLICY-SOCIAL Yahoo IM successful logon"

• "PUA-P2P GNUTella client request"

• "POLICY-MULTIMEDIA Icecast playlist redirection"

• "POLICY-SOCIAL IRC dns response"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router remote telnet enable attempt"

• "POLICY-SOCIAL ICQ access"

• "OS-MOBILE Nokia User-Agent detected"

• "SERVER-MAIL battle-mail traffic"

• "POLICY-SOCIAL Microsoft MSN login attempt"

• "OS-MOBILE Apple iPod User-Agent detected"

• "POLICY-SOCIAL IRC dns request"

• "PUA-OTHER Bitcoin Mining subscribe Stratum protocol client request attempt"

• "APP-DETECT Ufasoft bitcoin miner possible data upload"

• "POLICY-SOCIAL Microsoft MSN outbound file transfer accept"

• "POLICY-SOCIAL Yahoo IM conference invitation"

• "POLICY-SOCIAL IRC DCC file transfer request"

• "OS-MOBILE Android User-Agent detected"

• "POLICY-SOCIAL IRC nick change"

• "POLICY-MULTIMEDIA Shoutcast playlist redirection"

• "OS-MOBILE Apple iPhone User-Agent detected"

• "POLICY-SOCIAL Yahoo IM ping"

• "POLICY-SOCIAL Microsoft MSN outbound file transfer rejected"

• "OS-WINDOWS Microsoft Windows SMB anonymous user session setup request detected"

• "PUA-OTHER Bitcoin Mining authorize Stratum protocol client request attempt"

• "POLICY-SOCIAL Yahoo IM conference message"

• "POLICY-SOCIAL Yahoo IM conference offer invitation"

• "POLICY-SOCIAL ICQ forced user addition"

• "PUA-P2P GNUTella client request"

• "PUA-P2P Manolito Search Query"

• "APP-DETECT Ammyy remote access tool"

• "POLICY-SOCIAL Yahoo IM successful chat join"

• "POLICY-OTHER F5 iControl REST interface tm.util.bash invocation attempt"

• "POLICY-OTHER TRENDnet IP Camera anonymous access attempt"

• "POLICY-SOCIAL Yahoo IM conference logon success"

suspicious-login

• "PROTOCOL-TELNET EZsetup account attempt"

• "PROTOCOL-FTP Yak! FTP server default account login attempt"

• "PROTOCOL-FTP piss scan"

• "PROTOCOL-TELNET APC SmartSlot default admin account attempt"

• "SERVER-MAIL AUTH LOGON brute force attempt"

• "PROTOCOL-FTP adm scan"

• "PROTOCOL-FTP ADMw0rm ftp login attempt"

• "PROTOCOL-TELNET root login"

• "PROTOCOL-POP login brute force attempt"

• "SERVER-ORACLE misparsed login response"

• "PROTOCOL-FTP iss scan"

• "PROTOCOL-IMAP login brute force attempt"

• "PROTOCOL-FTP saint scan"

• "PROTOCOL-TELNET 4Dgifts SGI account attempt"

• "PROTOCOL-FTP satan scan"

• "PROTOCOL-FTP pass wh00t"

web-application-attack

• "SERVER-WEBAPP Blahz-DNS dostuff.php modify user attempt"

• "SERVER-WEBAPP perl post attempt"

• "SERVER-WEBAPP Talentsoft Web+ Source Code view access"

• "APP-DETECT Acunetix web vulnerability scanner base64 XSS attempt"

• "SERVER-WEBAPP auktion.cgi directory traversal attempt"

• "SERVER-WEBAPP SalesLogix Eviewer web command attempt"

• "SERVER-IIS iisadmin access"

• "SERVER-WEBAPP RBS ISP /newuser directory traversal attempt"

• "SERVER-APACHE Apache Tomcat view source attempt"

• "SERVER-WEBAPP input2.bat arbitrary command execution attempt"

• "SERVER-WEBAPP NetObserve authentication bypass attempt"

• "SERVER-WEBAPP rolis guestbook remote file include attempt"

• "SERVER-WEBAPP HyperSeek hsx.cgi directory traversal attempt"

• "SERVER-IIS idc-srch attempt"

• "SERVER-IIS .htr chunked Transfer-Encoding"

• "SERVER-WEBAPP CCBill whereami.cgi arbitrary command execution attempt"

• "SERVER-WEBAPP DNSTools administrator authentication bypass attempt"

• "SQL use of sleep function in HTTP header - likely SQL injection attempt"

• "APP-DETECT Acunetix web vulnerability scan attempt"

• "SERVER-OTHER Microsoft Frontpage .... request"

• "SERVER-WEBAPP Western Digital MyCloud command injection attempt"

• "SERVER-WEBAPP ans.pl attempt"

• "SERVER-WEBAPP store.cgi directory traversal attempt"

• "SERVER-WEBAPP post32.exe arbitrary command attempt"

• "SERVER-WEBAPP talkback.cgi directory traversal attempt"

• "SQL xp_availablemedia attempt"

• "SERVER-WEBAPP Linksys E-Series apply.cgi ping function command injection attempt"

• "SERVER-WEBAPP Invision Board ipchat.php file include"

• "SERVER-WEBAPP Lotus Notes .pl script source download attempt"

• "SERVER-OTHER Adobe Coldfusion settings refresh attempt"

• "SERVER-IIS ism.dll attempt"

• "SERVER-WEBAPP agora.cgi attempt"

• "SERVER-WEBAPP pmachine remote file include attempt"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SERVER-WEBAPP phf arbitrary command execution attempt"

• "BROWSER-OTHER Mozilla Netscape XMLHttpRequest local file read attempt"

• "SERVER-WEBAPP Nortel Contivity cgiproc DOS attempt"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SERVER-WEBAPP YaBB SE packages.php file include"

• "SERVER-WEBAPP forum_details.php access"

• "SERVER-WEBAPP cross site scripting HTML Image tag set to javascript attempt"

• "SERVER-IIS isc$data attempt"

• "SERVER-WEBAPP Netgear DGN2200 ping.cgi command injection attempt"

• "SERVER-OTHER Adobe Coldfusion set odbc ini attempt"

• "SERVER-WEBAPP jigsaw dos attempt"

• "SERVER-WEBAPP SmartWin CyberOffice Shopping Cart access"

• "SERVER-WEBAPP Lotus Notes .exe script source download attempt"

• "SERVER-IIS SmarterTools SmarterMail login.aspx buffer overflow attempt"

• "SQL xp_cmdshell attempt"

• "SERVER-WEBAPP directorypro.cgi attempt"

• "SERVER-APACHE Apache Tomcat servlet mapping cross site scripting attempt"

• "SERVER-WEBAPP Linksys E-Series apply.cgi directory traversal attempt"

• "SERVER-WEBAPP Typo3 translations.php file include"

• "SERVER-WEBAPP Western Digital MyCloud command injection attempt"

• "SERVER-WEBAPP nobody access"

• "SERVER-WEBAPP Joomla restore.php PHP object injection attempt"

• "SERVER-WEBAPP global.inc access"

• "APP-DETECT Acunetix web vulnerability scanner probe attempt"

• "SERVER-WEBAPP b2 cafelog gm-2-b2.php remote file include attempt"

• "SERVER-WEBAPP ttforum remote file include attempt"

• "SERVER-WEBAPP Nagios XI SQL injection attempt"

• "SERVER-IIS Microsoft Office Outlook web dos"

• "SERVER-WEBAPP formmail arbitrary command execution attempt"

• "SERVER-WEBAPP txt2html.cgi directory traversal attempt"

• "APP-DETECT Acunetix web vulnerability scanner URI injection attempt"

• "SERVER-WEBAPP DCP-Portal remote file include lib script attempt"

• "SERVER-WEBAPP Oracle 10g iSQLPlus login.unix connectID overflow attempt"

• "SERVER-WEBAPP amazon 1-click cookie theft"

• "SERVER-IIS CodeRed v2 root.exe access"

• "SERVER-WEBAPP Cisco DDR2200 ADSL gateway command injection attempt"

• "SERVER-WEBAPP Axis Storpoint CD attempt"

• "SERVER-WEBAPP Linksys E-Series apply.cgi directory traversal attempt"

• "SERVER-WEBAPP cgiforum.pl attempt"

• "SERVER-WEBAPP shopping cart directory traversal"

• "SERVER-WEBAPP WordPress get_post authentication bypass attempt"

• "SERVER-WEBAPP Opt-X header.php remote file include attempt"

• "SERVER-OTHER Adobe Coldfusion admin encrypt attempt"

• "SERVER-WEBAPP eshop.pl arbitrary command execution attempt"

• "SERVER-WEBAPP Netgear DGN2200 dnslookup.cgi command injection attempt"

• "SERVER-IIS perl-browse space attempt"

• "SERVER-APACHE Apache Chunked-Encoding worm attempt"

• "SERVER-WEBAPP bb-hostscv.sh attempt"

• "SERVER-IIS +.htr code fragment attempt"

• "SERVER-WEBAPP HttpOxy CGI application vulnerability potential man-in-the-middle attempt"

• "SERVER-WEBAPP view-source directory traversal"

• "SERVER-WEBAPP Nagios XI command injection attempt"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SERVER-WEBAPP Nortel Contivity cgiproc DOS attempt"

• "SERVER-WEBAPP JavaScript tag in User-Agent field possible XSS attempt"

• "SERVER-WEBAPP whois_raw.cgi arbitrary command execution attempt"

• "SERVER-WEBAPP htsearch arbitrary file read attempt"

• "SERVER-WEBAPP LG-Ericsson iPECS NMS 30M directory traversal attempt"

• "SERVER-WEBAPP SecureSite authentication bypass attempt"

• "SERVER-WEBAPP faqmanager.cgi arbitrary file access attempt"

• "SERVER-WEBAPP strings overflow"

• "SERVER-WEBAPP Oracle iSQLPlus login.uix username overflow attempt"

• "SERVER-WEBAPP loadpage.cgi directory traversal attempt"

• "SERVER-WEBAPP cached_feed.cgi moreover shopping cart directory traversal"

• "APP-DETECT Acunetix web vulnerability scanner prompt XSS attempt"

• "SERVER-WEBAPP echo.bat arbitrary command execution attempt"

• "SERVER-WEBAPP Internal field separator use in HTTP URI attempt"

• "SERVER-IIS ism.dll access"

• "SERVER-WEBAPP SIX webboard generate.cgi attempt"

• "SERVER-WEBAPP QNAP WTS 4.2.1 command injection attempt"

• "SERVER-WEBAPP Kaspersky Linux File Server WMC cross site request forgery attempt"

• "SERVER-OTHER Cisco denial of service attempt"

• "SERVER-IIS /scripts/samples/ access"

• "SERVER-WEBAPP iPlanet GETPROPERTIES attempt"

• "SERVER-WEBAPP Digital Guardian Management Console arbitrary file upload attempt"

• "SERVER-WEBAPP webplus directory traversal"

• "SERVER-WEBAPP input.bat arbitrary command execution attempt"

• "SERVER-IIS Form_JScript.asp access"

• "SERVER-WEBAPP NagiosXI SQL injection attempt"

• "SQL generic convert injection attempt - GET parameter"

• "SERVER-WEBAPP QNAP VioStor NVR and QNAP NAS command injection attempt"

• "SERVER-WEBAPP Netscape admin passwd"

• "SERVER-OTHER Adobe Coldfusion db connections flush attempt"

• "SERVER-WEBAPP LG-Ericsson iPECS NMS 30M directory traversal attempt"

• "SERVER-WEBAPP TRACE attempt"

• "SERVER-IIS Form_VBScript.asp access"

• "SERVER-WEBAPP Tpshop remote file include attempt"

• "SERVER-WEBAPP nessus 1.X 404 probe"

• "SERVER-OTHER Adobe Coldfusion getodbcdsn access"

• "SERVER-WEBAPP Netscape Enterprise DOS"

• "SERVER-WEBAPP QNAP VioStor NVR and QNAP NAS command injection attempt"

• "SERVER-WEBAPP SWSoft ASPSeek Overflow attempt"

• "SERVER-WEBAPP autohtml.php directory traversal attempt"

• "SERVER-WEBAPP Nagios XI command injection attempt"

• "SERVER-WEBAPP wayboard attempt"

• "SERVER-WEBAPP RealNetworks RealSystem Server DESCRIBE buffer overflow attempt"

• "SERVER-WEBAPP PhpGedView PGV config_gedcom.php base directory manipulation attempt"

• "SERVER-IIS MS Site Server default login attempt"

• "SERVER-IIS /msadc/samples/ access"

• "FILE-OTHER technote main.cgi file directory traversal attempt"

• "SERVER-WEBAPP webspirs.cgi directory traversal attempt"

• "SERVER-IIS /scripts/iisadmin/default.htm access"

• "APP-DETECT Acunetix web vulnerability scanner XSS attempt"

• "SERVER-WEBAPP Samba SWAT Authorization overflow attempt"

• "SERVER-WEBAPP cal_make.pl directory traversal attempt"

• "SERVER-WEBAPP Internal field separator use in HTTP URI attempt"

• "SERVER-WEBAPP Armada Style Master Index directory traversal"

• "SERVER-WEBAPP Allaire JRUN DOS attempt"

• "SERVER-WEBAPP Oracle iSQLPlus username overflow attempt"

• "SERVER-WEBAPP htsearch arbitrary configuration file attempt"

• "OS-OTHER Cisco IOS HTTP configuration attempt"

• "SERVER-WEBAPP SGI InfoSearch fname attempt"

• "SERVER-WEBAPP AltaVista Intranet Search directory traversal attempt"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SERVER-WEBAPP Nagios XI database settings modification attempt"

• "SERVER-IIS cmd32.exe access"

• "SERVER-IIS perl-browse newline attempt"

• "SERVER-IIS asp-srch attempt"

• "SERVER-WEBAPP QNAP WTS 4.2.1 command injection attempt"

• "SERVER-WEBAPP .htpasswd access attempt"

• "SERVER-OTHER Adobe Coldfusion datasource attempt"

• "SERVER-WEBAPP Netgear DGN2200 dnslookup.cgi command injection attempt"

• "SERVER-APACHE Apache Tomcat null byte directory listing attempt"

• "SERVER-WEBAPP WordPress get_post authentication bypass attempt"

• "SERVER-WEBAPP Linksys E-Series apply.cgi ping function command injection attempt"

• "SERVER-WEBAPP eXtropia webstore directory traversal"

• "SERVER-WEBAPP Cisco DDR2200 ADSL gateway command injection attempt"

• "SERVER-WEBAPP TwonkyMedia server directory listing attempt"

• "SERVER-WEBAPP Ubiquiti Networks UniFi Cloud Key Firm v0.6.1 Host Remote Command Execution attempt"

• "SERVER-WEBAPP Kaspersky Linux File Server WMC directory traversal attempt"

• "SERVER-WEBAPP Netscape Enterprise directory listing attempt"

• "SERVER-OTHER Adobe Coldfusion datasource passwordattempt"

• "SERVER-WEBAPP Anti-Web directory traversal attempt"

• "SERVER-WEBAPP MsmMask.exe attempt"

• "SERVER-WEBAPP Tpshop remote file include attempt"

• "SERVER-WEBAPP search.dll directory listing attempt"

• "SERVER-WEBAPP awstats.pl command execution attempt"

• "SERVER-IIS directory listing"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SERVER-IIS MS Site Server admin attempt"

• "SERVER-WEBAPP PhpGedView PGV functions.php base directory manipulation attempt"

• "SERVER-IIS Microsoft Windows IIS directory traversal attempt"

• "SERVER-WEBAPP QNAP WTS 4.2.1 command injection attempt"

• "SERVER-WEBAPP PHP-Wiki cross site scripting attempt"

• "SERVER-IIS /exchange/root.asp attempt"

• "SERVER-WEBAPP Lotus Domino directory traversal"

• "SERVER-OTHER Adobe Coldfusion getodbcin attempt"

• "SERVER-WEBAPP Samba SWAT Authorization port 901 overflow attempt"

• "SERVER-WEBAPP dcforum.cgi directory traversal attempt"

• "SERVER-WEBAPP AlienForm alienform.cgi directory traversal attempt"

• "SERVER-WEBAPP phpbb quick-reply.php arbitrary command attempt"

• "SERVER-OTHER Adobe Coldfusion startstop DOS access"

• "SERVER-WEBAPP .bash_history access"

• "SERVER-WEBAPP Mambo uploadimage.php upload php file attempt"

• "SERVER-WEBAPP Compaq Insight directory traversal"

• "POLICY-OTHER Cisco DDR2200 ASDL gateway file download detected"

• "SERVER-WEBAPP Kaspersky Linux File Server WMC directory traversal attempt"

• "SERVER-WEBAPP Bugtraq enter_bug.cgi arbitrary command attempt"

• "SERVER-WEBAPP answerbook2 arbitrary command execution attempt"

• "SERVER-WEBAPP WebLogic ConsoleHelp view source attempt"

• "SERVER-IIS .asa HTTP header buffer overflow attempt"

• "SERVER-WEBAPP Netgear DGN2200 ping.cgi command injection attempt"

• "SERVER-WEBAPP ttCMS header.php remote file include attempt"

• "SERVER-WEBAPP Nagios XI command injection attempt"

• "SERVER-WEBAPP Citrix ADC and Gateway arbitrary code execution attempt"

• "SERVER-WEBAPP test.bat arbitrary command execution attempt"

• "SERVER-IIS iissamples access"

• "SERVER-WEBAPP technote print.cgi directory traversal attempt"

• "INDICATOR-OBFUSCATION large number of calls to chr function - possible sql injection obfuscation"

• "SERVER-WEBAPP csSearch.cgi arbitrary command execution attempt"

• "SERVER-WEBAPP htgrep attempt"

• "SERVER-IIS asp-dot attempt"

• "SERVER-WEBAPP ttawebtop.cgi arbitrary file attempt"

• "SERVER-IIS scripts-browse access"

• "SERVER-IIS ASP contents view"

• "SERVER-WEBAPP hello.bat arbitrary command execution attempt"

• "SERVER-WEBAPP ICQ Webfront HTTP DOS"

• "OS-WINDOWS SAP Crystal Reports crystalImageHandler.asp directory traversal attempt"

• "SERVER-WEBAPP Netgear DGN2200 dnslookup.cgi command injection attempt"

• "SERVER-WEBAPP Oracle iSQLPlus sid overflow attempt"

• "SERVER-WEBAPP DotNetNuke DreamSlider arbitrary file download attempt"

• "SERVER-WEBAPP LG-Ericsson iPECS NMS 30M directory traversal attempt"

• "SERVER-WEBAPP book.cgi arbitrary command execution attempt"

• "SERVER-WEBAPP gallery remote file include attempt"

• "SERVER-WEBAPP Cisco DDR2200 ADSL gateway command injection attempt"

• "SERVER-WEBAPP PayPal Storefront remote file include attempt"

• "SERVER-WEBAPP sojourn.cgi File attempt"

• "SERVER-WEBAPP LG-Ericsson iPECS NMS 30M directory traversal attempt"

• "SERVER-WEBAPP Netgear DGN2200 dnslookup.cgi command injection attempt"

• "SERVER-WEBAPP strings overflow"

• "SERVER-WEBAPP FormHandler.cgi external site redirection attempt"

• "SERVER-WEBAPP pfdispaly.cgi arbitrary command execution attempt"

• "SERVER-WEBAPP Allaire Pro Web Shell attempt"

• "SERVER-WEBAPP mailman cross site scripting attempt"

• "SERVER-IIS ASP contents view"

• "SERVER-IIS ISAPI .idq attempt"

• "SERVER-WEBAPP ads.cgi command execution attempt"

• "SERVER-WEBAPP Cisco HTTP double-percent DOS attempt"

• "SERVER-WEBAPP Digital Guardian Management Console arbitrary file upload attempt"

• "SERVER-IIS .cmd executable file parsing attack"

• "SERVER-WEBAPP Nagios XI command injection attempt"

• "SERVER-IIS fpcount attempt"

• "SERVER-WEBAPP Netgear DGN2200 ping.cgi command injection attempt"

• "SERVER-WEBAPP alibaba.pl arbitrary command execution attempt"

• "SERVER-WEBAPP remote include path attempt"

• "SERVER-WEBAPP BLNews objects.inc.php4 remote file include attempt"

• "SERVER-IIS Unauthorized IP Access Attempt"

• "SERVER-IIS .cer HTTP header buffer overflow attempt"

• "SERVER-WEBAPP Kaspersky Linux File Server WMC directory traversal attempt"

• "SERVER-WEBAPP Netscape Enterprise Server directory view"

• "SERVER-WEBAPP Cisco DDR2200 ADSL gateway command injection attempt"

• "SERVER-WEBAPP Mambo upload.php upload php file attempt"

• "SERVER-WEBAPP AlienForm af.cgi directory traversal attempt"

• "SERVER-WEBAPP WordPress get_post authentication bypass attempt"

• "SERVER-WEBAPP MDaemon form2raw.cgi overflow attempt"

• "SERVER-WEBAPP Macromedia SiteSpring cross site scripting attempt"

• "SERVER-WEBAPP content-disposition memchr overflow"

• "SERVER-OTHER Adobe Coldfusion displayfile access"

• "INDICATOR-COMPROMISE script before DOCTYPE possible malicious redirect attempt"

• "SERVER-WEBAPP musicat empower attempt"

• "SERVER-IIS MDAC Content-Type overflow attempt"

• "SERVER-WEBAPP QNAP WTS 4.2.1 command injection attempt"

• "SERVER-IIS .asp chunked Transfer-Encoding"

• "SERVER-WEBAPP bb-hist.sh attempt"

• "SERVER-WEBAPP mrtg.cgi directory traversal attempt"

• "SERVER-IIS Alternate Data streams ASP file access attempt"

• "SERVER-WEBAPP *%20.pl access"

• "SERVER-WEBAPP PHP-Nuke remote file include attempt"

• "SERVER-WEBAPP jrun directory browse attempt"

• "SERVER-WEBAPP PhpGedView PGV authentication_index.php base directory manipulation attempt"

• "SERVER-IIS del attempt"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SERVER-WEBAPP QNAP VioStor NVR and QNAP NAS command injection attempt"

• "SERVER-WEBAPP ustorekeeper.pl directory traversal attempt"

• "SERVER-WEBAPP mailman directory traversal attempt"

• "SERVER-WEBAPP Compaq web-based management agent denial of service attempt"

• "SERVER-IIS .cdx HTTP header buffer overflow attempt"

• "SERVER-IIS cmd? access"

• "SERVER-IIS .bat executable file parsing attack"

• "SERVER-WEBAPP dcboard.cgi invalid user addition attempt"

• "SERVER-WEBAPP envout.bat arbitrary command execution attempt"

• "SERVER-WEBAPP /cgi-bin/ access"

• "SERVER-OTHER libgd heap-overflow attempt"

• "SERVER-WEBAPP phpMyAdmin db_details_importdocsql.php access"

• "SERVER-WEBAPP weblogic/tomcat .jsp view source attempt"

• "SERVER-IIS ISAPI .ida attempt"

• "SERVER-WEBAPP handler attempt"

• "SERVER-WEBAPP Phorum /support/common.php attempt"

• "SERVER-WEBAPP bizdbsearch attempt"

• "APP-DETECT Acunetix web vulnerability scanner authentication attempt"

• "SERVER-WEBAPP BitKeeper arbitrary command attempt"

• "SERVER-WEBAPP test-cgi attempt"

• "SERVER-WEBAPP DCP-Portal remote file include editor script attempt"

• "SERVER-WEBAPP Talentsoft Web+ exploit attempt"

• "SERVER-WEBAPP PHPNuke Forum viewtopic SQL insertion attempt"

• "SERVER-WEBAPP campas attempt"

• "SERVER-WEBAPP Netscape Servers suite DOS"

• "SERVER-WEBAPP WebChat english.php file include"

• "SERVER-WEBAPP iPlanet Search directory traversal attempt"

• "SERVER-WEBAPP DNSTools authentication bypass attempt"

• "SERVER-WEBAPP Western Digital MyCloud command injection attempt"

• "SERVER-WEBAPP oracle web arbitrary command execution attempt"

• "SERVER-WEBAPP WAnewsletter newsletter.php file include attempt"

• "SERVER-WEBAPP Anti-Web directory traversal attempt"

• "SERVER-WEBAPP PCCS mysql database admin tool access"

• "SERVER-WEBAPP pals-cgi arbitrary file access attempt"

• "SERVER-WEBAPP squirrel mail theme arbitrary command attempt"

• "SERVER-IIS Malformed Hit-Highlighting Argument File Access Attempt"

• "SERVER-ORACLE Oracle WebCenter FatWire Satellite Server header injection on blobheadername2 attempt"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SQL xp_enumdsn attempt"

• "SERVER-OTHER Adobe Coldfusion datasource username attempt"

• "SERVER-WEBAPP news.php file include"

• "SERVER-WEBAPP webdist.cgi arbitrary command attempt"

• "SERVER-WEBAPP calendar_admin.pl arbitrary command execution attempt"

• "SERVER-WEBAPP QNAP VioStor NVR and QNAP NAS command injection attempt"

• "SERVER-WEBAPP Home Free search.cgi directory traversal attempt"

• "SERVER-WEBAPP Amaya templates sendtemp.pl directory traversal attempt"

• "SERVER-WEBAPP Akeeba Kickstart cross site request forgery attempt"

• "SERVER-WEBAPP imagemap.exe overflow attempt"

• "SERVER-WEBAPP PhpGedView PGV base directory manipulation"

• "SERVER-WEBAPP htmlscript attempt"

• "SERVER-WEBAPP anaconda directory traversal attempt"

• "SERVER-WEBAPP philboard_admin.asp authentication bypass attempt"

• "SERVER-WEBAPP Akeeba Kickstart restoration.php reconnaissance attempt"

• "SERVER-WEBAPP Linksys E-Series apply.cgi ping function command injection attempt"

• "SERVER-WEBAPP .history access"

• "SERVER-WEBAPP Lotus Notes .csp script source download attempt"

• "SERVER-WEBAPP content-disposition file upload attempt"

• "SERVER-OTHER Adobe Coldfusion admin decrypt attempt"

• "SERVER-OTHER QNAP QTS X-Forwarded-For buffer overflow"

• "SERVER-IIS *.idc attempt"

• "SQL xp_filelist attempt"

• "SERVER-WEBAPP myphpPagetool pt_config.inc file include"

• "SERVER-WEBAPP Belkin N750 F9K1103 wireless router command injection attempt"

• "SERVER-ORACLE Oracle WebCenter FatWire Satellite Server header injection on blobheadername2 attempt"

• "INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload"

• "SERVER-IIS iisadmpwd attempt"

• "SERVER-WEBAPP vBulletin XSS redirect attempt"

• "SERVER-WEBAPP squirrel mail spell-check arbitrary command attempt"

• "SERVER-WEBAPP Ipswitch WhatsUpGold instancename overflow attempt"

• "SERVER-WEBAPP Anti-Web directory traversal attempt"

• "SERVER-APACHE Apache chunked-encoding worm attempt"

• "SERVER-WEBAPP Western Digital MyCloud command injection attempt"

• "SERVER-WEBAPP Magecart inbound scan for vulnerable plugin attempt"

• "SERVER-WEBAPP Web Shopper shopper.cgi attempt"

• "SERVER-WEBAPP unify eWave ServletExec upload"

• "SERVER-WEBAPP WebChat db_mysql.php file include"

• "APP-DETECT Acunetix web vulnerability scanner RFI attempt"

• "SERVER-WEBAPP Phorum /support/common.php access"

• "SERVER-OTHER OpenSSL Worm traffic"

• "SERVER-WEBAPP b2 arbitrary command execution attempt"

• "SERVER-WEBAPP Remote Execution Backdoor Attempt Against Horde"

• "SERVER-WEBAPP ftp.pl attempt"

• "SERVER-WEBAPP viewtopic.php access"

• "SERVER-WEBAPP /cgi-dos/ access"

• "SERVER-WEBAPP Citrix ADC and Gateway arbitrary code execution attempt"

• "SERVER-OTHER libgd heap-overflow attempt"

• "SERVER-IIS cmd.exe access"

• "SERVER-WEBAPP a1stats a1disp3.cgi directory traversal attempt"

• "SERVER-WEBAPP FormHandler.cgi directory traversal attempt"

• "SERVER-WEBAPP shoutbox.php directory traversal attempt"

bad-unknown

• "INDICATOR-COMPROMISE file copied ok"

• "INDICATOR-COMPROMISE index of /cgi-bin/ response"

• "PROTOCOL-FTP serv-u directory traversal"

• "PROTOCOL-FTP CWD ~root attempt"

• "PROTOCOL-FTP SITE EXEC attempt"

• "INDICATOR-SCAN XTACACS logout"

• "INDICATOR-COMPROMISE nimda RICHED20.DLL"

• "PROTOCOL-TFTP NULL command attempt"

• "PROTOCOL-DNS SPOOF query response PTR with TTL of 1 min. and no authority"

• "PROTOCOL-SERVICES rlogin echo++"

• "PROTOCOL-DNS SPOOF query response with TTL of 1 min. and no authority"

• "PROTOCOL-FTP Bad login"

• "INDICATOR-COMPROMISE id check returned userid"

• "INDICATOR-COMPROMISE directory listing"

• "PROTOCOL-TELNET not on console"

• "INDICATOR-COMPROMISE Unknown ?1 redirect"

• "INDICATOR-OBFUSCATION hex escaped characters in setTimeout call"

• "PROTOCOL-TFTP root directory"

• "PROTOCOL-TFTP parent directory"

• "INDICATOR-OBFUSCATION hex escaped characters in addEventListener call"

• "PROTOCOL-FTP SITE EXEC format string attempt"

• "PROTOCOL-TELNET login incorrect"

• "BROWSER-FIREFOX Possible Mozilla Firefox Plugin install from non-Mozilla source"

• "POLICY-SPAM 1.usa.gov URL in email, possible spam redirect"

• "APP-DETECT psyBNC access"

• "PROTOCOL-TELNET login failed"

• "SERVER-OTHER ramen worm"

• "BROWSER-WEBKIT Possible Google Chrome Plugin install from non-trusted source"

• "PROTOCOL-FTP CWD ..."

• "INDICATOR-COMPROMISE IP only webpage redirect attempt"

• "PROTOCOL-TFTP Put"

• "SERVER-OTHER Insecure TIMBUKTU Password"

• "INDICATOR-COMPROMISE command error"

• "PROTOCOL-FTP tar parameters"

• "INDICATOR-SCAN cybercop udp bomb"

• "INDICATOR-COMPROMISE IP only webpage redirect attempt"

• "INDICATOR-COMPROMISE oracle one hour install"

• "INDICATOR-COMPROMISE id check returned root"

• "SERVER-OTHER gopher proxy"

• "PROTOCOL-SERVICES rlogin LinuxNIS"

• "INDICATOR-COMPROMISE command completed"

• "MALWARE-OTHER malicious redirection attempt"

• "PROTOCOL-TFTP Get"

shellcode-detect

• "INDICATOR-SHELLCODE HP-UX NOOP"

• "INDICATOR-SHELLCODE SGI NOOP"

• "INDICATOR-SHELLCODE x86 inc ebx NOOP"

• "INDICATOR-SHELLCODE ssh CRC32 overflow /bin/sh"

• "INDICATOR-SHELLCODE ssh CRC32 overflow filler"

• "INDICATOR-SHELLCODE SGI NOOP"

• "INDICATOR-SHELLCODE HP-UX NOOP"

• "INDICATOR-SHELLCODE kadmind buffer overflow attempt"

• "INDICATOR-SHELLCODE kadmind buffer overflow attempt"

• "INDICATOR-SHELLCODE sparc NOOP"

• "INDICATOR-SHELLCODE shellcode attempt"

• "INDICATOR-SHELLCODE sparc NOOP"

• "INDICATOR-SHELLCODE Linux shellcode"

• "INDICATOR-SHELLCODE kadmind buffer overflow attempt"

• "INDICATOR-SHELLCODE x86 NOOP"

• "INDICATOR-SHELLCODE kadmind buffer overflow attempt"

• "INDICATOR-SHELLCODE shellcode attempt"

• "INDICATOR-SHELLCODE x86 inc ecx NOOP"

• "INDICATOR-SHELLCODE kadmind buffer overflow attempt"

• "INDICATOR-SHELLCODE kadmind buffer overflow attempt"

• "INDICATOR-SHELLCODE sparc NOOP"

• "INDICATOR-SHELLCODE shellcode attempt"

• "INDICATOR-SHELLCODE Digital UNIX NOOP"

• "INDICATOR-SHELLCODE ssh CRC32 overflow NOOP"

• "INDICATOR-SHELLCODE ssh CRC32 overflow"

• "INDICATOR-SHELLCODE AIX NOOP"

suspicious-filename-detect

• "PROTOCOL-FTP passwd retrieval attempt"

• "PROTOCOL-FTP shadow retrieval attempt"

• "PROTOCOL-FTP authorized_keys"

• "INDICATOR-COMPROMISE FTP file_id.diz access possible warez site"

• "PROTOCOL-FTP .rhosts"

• "PROTOCOL-FTP .forward"

successful-admin

• "SERVER-OTHER successful gobbles ssh exploit GOBBLE"

• "INDICATOR-COMPROMISE Microsoft cmd.exe banner"

• "PROTOCOL-TFTP GET nc.exe"

• "PROTOCOL-TFTP GET Admin.dll"

• "PROTOCOL-TFTP GET passwd"

• "PROTOCOL-TELNET bsd exploit client finishing"

• "PROTOCOL-TFTP GET shadow"

• "INDICATOR-COMPROMISE Microsoft cmd.exe banner"

• "SERVER-OTHER successful kadmind buffer overflow attempt"

• "SERVER-OTHER successful kadmind buffer overflow attempt"

successful-recon-limited

• "PROTOCOL-ICMP Unusual Microsoft Windows Ping detected"

• "PROTOCOL-ICMP Unusual L3retriever Ping detected"

• "PROTOCOL-ICMP Unusual Microsoft Windows 7 Ping detected"

• "PROTOCOL-ICMP Unusual PING detected"

unsuccessful-user

• "NETBIOS SMB-DS repeated logon failure"

• "BROWSER-OTHER Netscape 4.7 unsucessful overflow"

• "INDICATOR-COMPROMISE rexec username too long response"

• "SQL sa brute force failed login attempt"

• "PROTOCOL-SERVICES rlogin login failure"

• "NETBIOS SMB repeated logon failure"

• "SQL sa login failed"

• "PROTOCOL-SERVICES rlogin login failure"

• "SQL sa brute force failed login unicode attempt"

• "PUA-OTHER PCAnywhere Failed Login"

denial-of-service

• "SERVER-OTHER OpenBSD ISAKMP denial of service attempt"

• "SERVER-OTHER DB2 dos attempt"

• "SERVER-OTHER Mikrotik RouterOS denial of service attempt"

• "PROTOCOL-FTP CWD ~ attempt"

• "SERVER-WEBAPP Linksys E series denial of service attempt"

network-scan

• "PROTOCOL-ICMP SolarWinds IP scan attempt"

• "MALWARE-CNC User-Agent ASafaWeb Scan"

• "INDICATOR-SCAN SSH Version map attempt"

• "MALWARE-CNC URI - known scanner tool muieblackcat"

• "MALWARE-CNC User-Agent known malicious user-agent string Morfeus Scanner"

• "MALWARE-CNC User-Agent known malicious user-agent string DataCha0s"

• "INDICATOR-SCAN UPnP service discover attempt"

default-login-attempt

• "SERVER-WEBAPP NetGear router default password login attempt admin/password"

• "SERVER-OTHER QNAP QTS hard coded credential access attempt"

• "SERVER-WEBAPP Linksys router default username and password login attempt"

• "SERVER-WEBAPP Linksys router default password login attempt"

• "SERVER-WEBAPP Oracle JavaServer default password login attempt"

• "POLICY-OTHER QLogic Switch 5600/5800 default ftp login attempt"

• "POLICY-OTHER QLogic Switch 5600/5800 default ftp login attempt"

• "SERVER-WEBAPP Interactive Story story.pl access"

• "SERVER-WEBAPP Interactive Story story.pl arbitrary file read attempt"

string-detect

• "PROTOCOL-FTP format string attempt"

• "SERVER-OTHER rsync backup-dir directory traversal attempt"

system-call-detect

• "INDICATOR-SHELLCODE x86 setgid 0"

• "SERVER-OTHER LPD dvips remote command execution attempt"

• "INDICATOR-SHELLCODE Oracle sparc setuid 0"

• "INDICATOR-SHELLCODE x86 setuid 0"

• "SERVER-ORACLE EXECUTE_SYSTEM attempt"

unknown

• "X11 xopen"

• "PROTOCOL-FTP no password"

successful-user

• "INDICATOR-COMPROMISE successful cross site scripting forced download attempt"

non-standard-protocol

• "SERVER-WEBAPP invalid HTTP version string"