시그니처 리스트, Signature List
번호날짜ID시그니처 (Total Ruleset: 27,111개)
9,3612015/01/20 2012006  ET WEB_SPECIFIC_APPS MassMirror Uploader example_1.php Remote File Inclusion attempt; [1] 
9,3602015/01/20 2012005  ET WEB_SPECIFIC_APPS digiSHOP cart.php UPDATE SET SQL Injection Attempt; [1] 
9,3592015/01/20 2012004  ET WEB_SPECIFIC_APPS digiSHOP cart.php INSERT INTO SQL Injection Attempt; [1] 
9,3582015/01/20 2012003  ET WEB_SPECIFIC_APPS digiSHOP cart.php UNION SELECT SQL Injection Attempt; [1] 
9,3572015/01/20 2012002  ET WEB_SPECIFIC_APPS digiSHOP cart.php DELETE FROM SQL Injection Attempt; [1] 
9,3562015/01/20 2012001  ET WEB_SPECIFIC_APPS digiSHOP cart.php SELECT FROM SQL Injection Attempt; [1] 
9,3552015/01/20 2012000  ET MALWARE ASKTOOLBAR.DLL Reporting; [1] 
9,3542015/01/20 2011999  ET TROJAN Trojan.Spy.YEK MAC and IP POST; [1] 
9,3532015/01/20 2011996  ET TROJAN Darkness DDoS Bot Checkin; [1,2,3,4,5,6] 
9,3522015/01/20 2011995  ET TROJAN Suspicious invoice.scr Download Request;  
9,3512015/01/20 2011994  ET FTP ProFTPD Backdoor Inbound Backdoor Open Request (ACIDBITCHEZ); [1,2,3] 
9,3502015/01/20 2011993  ET DELETED ProFTPD Backdoor outbound Request Sent; [1,2,3] 
9,3492015/01/20 2011992  ET DELETED Possible ProFTPD Backdoor Initiate Attempt; [1,2,3] 
9,3482015/01/20 2011991  ET TROJAN FAKEAV Gemini systempack exe download;  
9,3472015/01/20 2011990  ET DELETED Suspicious executable download possible Rogue AV (installer.xxxx.exe); [1] 
9,3462015/01/20 2011989  ET TROJAN Suspicious executable download adobe-flash.v; [1] 
9,3452015/01/20 2011988  ET CURRENT_EVENTS Phoenix-style Exploit Kit Java Request with semicolon in URI;  
9,3442015/01/20 2011987  ET WEB_SPECIFIC_APPS Softbiz Article Directory Script sbiz_id Parameter Blind SQL Injection Attempt; [1] 
9,3432015/01/20 2011986  ET DELETED Suspicious executable download possible Fast Flux Rogue Antivirus RunAV; [1,2,3,4] 
9,3422015/01/20 2011985  ET DELETED Suspicious executable download possible Fast Flux Rogue Antivirus avdistr; [1,2,3,4] 
9,3412015/01/20 2011984  ET DELETED Suspicious executable download possible Fast Flux Rogue Antivirus MalvRem; [1,2,3,4] 
9,3402015/01/20 2011983  ET DELETED Suspicious executable download possible Fast Flux Trojan; [1] 
9,3392015/01/20 2011982  ET TROJAN Suspicious flash_player.exe Download; [1] 
9,3382015/01/20 2011981  ET DELETED Suspicious executable download possible Eleonore Exploit Pack / Trojan Brebolab; [1] 
9,3372015/01/20 2011980  ET DELETED Suspicious executable download possible Ircbrute Trojan; [1] 
9,3362015/01/20 2011979  ET TROJAN FedEX Spam Inbound;  
9,3352015/01/20 2011978  ET CURRENT_EVENTS MALVERTISING Alureon JavaScript IFRAME Redirect;  
9,3342015/01/20 2011976  ET SCADA RealWin SCADA System Buffer Overflow; [1] 
9,3332015/01/20 2011975  ET SCAN RatProxy in-use;  
9,3322015/01/20 2011974  ET SCAN Metasploit WMAP GET len 0 and type;  
9,3312015/01/20 2011973  ET CURRENT_EVENTS JAR served from /tmp/ could be Phoenix Exploit Kit;  
9,3302015/01/20 2011972  ET CURRENT_EVENTS PDF served from /tmp/ could be Phoenix Exploit Kit;  
9,3292015/01/20 2011970  ET CURRENT_EVENTS SWF served from /tmp/;  
9,3282015/01/20 2011969  ET TROJAN Ponmocup C2 Post-infection Checkin;  
9,3272015/01/20 2011968  ET DELETED Trojan Banker (AS33182); [1] 
9,3262015/01/20 2011967  ET TROJAN Suspicious bot.exe Request; [1] 
9,3252015/01/20 2011966  ET DELETED Trojan downloader (AS8514); [1] 
9,3242015/01/20 2011962  ET DELETED FAKEAV client requesting fake scanner page;  
9,3232015/01/20 2011961  ET DELETED MALVERTISING SEO iframe redirect to drive by 2;  
9,3222015/01/20 2011960  ET DELETED MALVERTISING SEO iframe redirect to drive by;  
9,3212015/01/20 2011959  ET DELETED DRIVEBY SEO Obfuscated JavaScript srctable;  
9,3202015/01/20 2011958  ET DELETED DRIVEBY SEO Obfuscated JavaScript desttable;  
9,3192015/01/20 2011957  ET DELETED DRIVEBY SEO Landing Page Encountered;  
9,3182015/01/20 2011956  ET DELETED DRIVEBY SEO Client Requesting Malicious loadpeers.php;  
9,3172015/01/20 2011955  ET DELETED DRIVEBY SEO Client Requesting Malicious lib.pdf;  
9,3162015/01/20 2011954  ET DELETED DRIVEBY SEO Client Requesting Malicious loadjjar.php;  
9,3152015/01/20 2011953  ET DELETED DRIVEBY SEO Client Requesting Malicious jjar.jar;  
9,3142015/01/20 2011952  ET DELETED DRIVEBY SEO Client Exploited By PDF;  
9,3132015/01/20 2011951  ET DELETED DRIVEBY SEO Client Exploited By SMB/JavaWebStart;  
9,3122015/01/20 2011950  ET WEB_SPECIFIC_APPS AWCM header.php Remote File Inclusion Attempt; [1] 
< 351  352  353  354  355  356  357  358  359  360 >
GigaVPN & GigaIPS is based MikroTik, Suricata and EmergingThreats.
Copyright ⓒ 2010 . All Rights Reserved.