| 번호 | 날짜 | ID | 시그니처 (Total Ruleset: 27,111개) | | 9,011 | 2015/01/20 | 2011525 | ET POLICY OpenSSL Demo Cert Exchange; | | 9,010 | 2015/01/20 | 2011524 | ET DELETED Knok.php Shiz or Rohimafo Host Information Submission to CnC Server; [1,2,3,4] | | 9,009 | 2015/01/20 | 2011523 | ET TROJAN Shiz or Rohimafo Reporting Listening Socket to CnC Server; [1,2,3,4] | | 9,008 | 2015/01/20 | 2011522 | ET DELETED Shiz or Rohimafo config loaded; [1,2,3,4] | | 9,007 | 2015/01/20 | 2011521 | ET DELETED Shiz or Rohimafo config download; [1,2,3,4] | | 9,006 | 2015/01/20 | 2011520 | ET TROJAN Knock.php Shiz or Rohimafo CnC Server Contact URL; [1,2,3,4] | | 9,005 | 2015/01/20 | 2011519 | ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt; [1] | | 9,004 | 2015/01/20 | 2011518 | ET MALWARE Outbound AlphaServer User-Agent (Powered By 64-Bit Alpha Processor); | | 9,003 | 2015/01/20 | 2011517 | ET MALWARE Inbound AlphaServer User-Agent (Powered By 64-Bit Alpha Processor); | | 9,002 | 2015/01/20 | 2011515 | ET DELETED Phoenix Exploit Kit - collab.pdf; | | 9,001 | 2015/01/20 | 2011514 | ET DELETED Phoenix Exploit Kit - tmp/flash.swf; | | 9,000 | 2015/01/20 | 2011513 | ET DELETED Possible Phoenix Exploit Kit - PROPFIND AVI; | | 8,999 | 2015/01/20 | 2011512 | ET DOS ntop Basic-Auth DOS outbound; [1,2,3] | | 8,998 | 2015/01/20 | 2011511 | ET DOS ntop Basic-Auth DOS inbound; [1,2,3] | | 8,997 | 2015/01/20 | 2011510 | ET DELETED DRIVEBY Eleonore - landing page; | | 8,996 | 2015/01/20 | 2011509 | ET ACTIVEX Possible Novell iPrint Client Browser Plugin ExecuteRequest debug Parameter Stack Overflow Attempt; [1,2] | | 8,995 | 2015/01/20 | 2011507 | ET WEB_CLIENT PDF With Embedded File; [1] | | 8,994 | 2015/01/20 | 2011506 | ET WEB_CLIENT PDF With eval Function - Possibly Hostile; [1] | | 8,993 | 2015/01/20 | 2011505 | ET WEB_CLIENT PDF With Embedded Flash, Possible Remote Code Execution Attempt; [1] | | 8,992 | 2015/01/20 | 2011504 | ET WEB_CLIENT String Replace in PDF File, Likely Hostile; [1] | | 8,991 | 2015/01/20 | 2011503 | ET EXPLOIT Successful Etrust Secure Transaction Platform Identification and Entitlements Server File Disclosure Attempt; [1,2] | | 8,990 | 2015/01/20 | 2011502 | ET EXPLOIT Possible Etrust Secure Transaction Platform Identification and Entitlements Server File Disclosure Attempt; [1,2] | | 8,989 | 2015/01/20 | 2011501 | ET WEB_CLIENT Possible Adobe CoolType Smart INdependent Glyplets - SING - Table uniqueName Stack Buffer Overflow Attempt; [1] | | 8,988 | 2015/01/20 | 2011500 | ET WEB_CLIENT Possible Adobe Acrobat and Reader Pushstring Memory Corruption Attempt; [1] | | 8,987 | 2015/01/20 | 2011499 | ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash, Possibly Related to Remote Code Execution Attempt; [1] | | 8,986 | 2015/01/20 | 2011497 | ET SCAN Hydra User-Agent; [1] | | 8,985 | 2015/01/20 | 2011496 | ET TROJAN Executable Download named to be FQDN; [1] | | 8,984 | 2015/01/20 | 2011495 | ET TROJAN Executable Download named to be .com FQDN; [1] | | 8,983 | 2015/01/20 | 2011494 | ET WEB_SPECIFIC_APPS OpenX OpenFlashChart Remote Exploit - possible Access to uploaded Files; [1,2,3,4,5,6,7] | | 8,982 | 2015/01/20 | 2011493 | ET WEB_SPECIFIC_APPS OpenX OpenFlashChart Remote Exploit Attempt; [1,2,3,4,5,6,7] | | 8,981 | 2015/01/20 | 2011492 | ET TROJAN Adware.Kraddare Checkin; | | 8,980 | 2015/01/20 | 2011491 | ET TROJAN Downloader.Win32.Zlob.bgs Checkin(2); [1] | | 8,979 | 2015/01/20 | 2011490 | ET TROJAN Downloader.Win32.Zlob.bgs Checkin(1); [1] | | 8,978 | 2015/01/20 | 2011489 | ET TROJAN Meredrop/Nusump Checkin; [1,2,3] | | 8,977 | 2015/01/20 | 2011488 | ET FTP Suspicious Quotation Mark Usage in FTP Username; [1] | | 8,976 | 2015/01/20 | 2011487 | ET FTP Suspicious Percentage Symbol Usage in FTP Username; [1] | | 8,975 | 2015/01/20 | 2011486 | ET DELETED Phoenix landing page - valium; | | 8,974 | 2015/01/20 | 2011485 | ET WEB_CLIENT RealPlayer FLV Parsing Integer Overflow Attempt; [1,2] | | 8,973 | 2015/01/20 | 2011484 | ET TROJAN IMDDOS Botnet User-Agent i am ddos; [1] | | 8,972 | 2015/01/20 | 2011483 | ET TROJAN IMDDOS Botnet User-Agent YTDDOS; [1] | | 8,971 | 2015/01/20 | 2011482 | ET TROJAN IMDDOS Botnet User-Agent kav; [1] | | 8,970 | 2015/01/20 | 2011481 | ET TROJAN IMDDOS Botnet User-Agent IAMDDOS; [1] | | 8,969 | 2015/01/20 | 2011480 | ET TROJAN IMDDOS Botnet User-Agent STORMDDOS; [1] | | 8,968 | 2015/01/20 | 2011479 | ET DELETED MALVERTISING redirect to exploit kit (unoeuro server); | | 8,967 | 2015/01/20 | 2011478 | ET EXPLOIT Possible Microsoft Office Word 2007 sprmCMajority Buffer Overflow Attempt; [1,2] | | 8,966 | 2015/01/20 | 2011475 | ET TROJAN FAKEAV scanner page enocuntered - .hdd_icon; | | 8,965 | 2015/01/20 | 2011474 | ET DELETED FakeAV Checkin; | | 8,964 | 2015/01/20 | 2011473 | ET TROJAN Antivirus2010 Checkin port 8082; [1,2] | | 8,963 | 2015/01/20 | 2011472 | ET WEB_CLIENT Possible Microsoft Internet Explorer CSS Cross-Origin Theft Attempt; [1,2,3] | | 8,962 | 2015/01/20 | 2011471 | ET TROJAN Daurso Checkin; [1,2,3,4] | | < 361 362 363 364 365 366 367 368 369 370 > |
|