API tools faq
paste
ImGlaCiuS

VirusTotal + IDS rules

ImGlaCiuS
Feb 11th, 2021 (edited)
16,818
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.63 KB | None | 0 0
raw download clone embed print report
  1. IDS rules currently running on VirusTotal, and what request to use on VirusTotal to find file matches :
  2.  
  3. - ET POLICY Application Crash Report Sent to Microsoft : crowdsourced_ids:"ET POLICY Application Crash Report Sent to Microsoft"
  4. - ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) : crowdsourced_ids:"ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)"
  5. - ET POLICY External IP Lookup (ipify .org): crowdsourced_ids:"ET POLICY External IP Lookup (ipify .org)"
  6. - ET MALWARE Win32/Ficker Stealer Activity M3: crowdsourced_ids:"ET MALWARE Win32/Ficker Stealer Activity M3"
  7. - PSNG_IP_PORTSWEEP_FILTERED : crowdsourced_ids:"PSNG_IP_PORTSWEEP_FILTERED"
  8. - PSNG_TCP_PORTSWEEP_FILTERED : crowdsourced_ids:"PSNG_TCP_PORTSWEEP_FILTERED"
  9. - PSNG_TCP_PORTSWEEP : crowdsourced_ids:"PSNG_TCP_PORTSWEEP"
  10. - ET INFO TLS Handshake Failure : crowdsourced_ids:"ET INFO TLS Handshake Failure"
  11. - ET POLICY PE EXE or DLL Windows file download HTTP : crowdsourced_ids:"ET POLICY PE EXE or DLL Windows file download HTTP"
  12. - ET MALWARE Amadey CnC Check-In : crowdsourced_ids:"ET MALWARE Amadey CnC Check-In"
  13. - ET INFO Executable Download from dotted-quad Host : crowdsourced_ids:"ET INFO Executable Download from dotted-quad Host"
  14. - ET MALWARE Single char EXE direct download likely trojan (multiple families) : crowdsourced_ids:"ET MALWARE Single char EXE direct download likely trojan (multiple families)"
  15. - MALWARE-CNC Win.Trojan.Amadey botnet outbound connection : crowdsourced_ids:"MALWARE-CNC Win.Trojan.Amadey botnet outbound connection"
  16. - MALWARE-CNC User-Agent known malicious user-agent string Uploador - Win.Trojan.CrossRAT : crowdsourced_ids:"MALWARE-CNC User-Agent known malicious user-agent string Uploador - Win.Trojan.CrossRAT"
  17. - STREAM5_NO_TIMESTAMP : crowdsourced_ids:"STREAM5_NO_TIMESTAMP"
  18. - EVENT_LOSS_OF_SYNC : crowdsourced_ids:"EVENT_LOSS_OF_SYNC"
  19. - ET POLICY curl User-Agent Outbound : crowdsourced_ids:"ET POLICY curl User-Agent Outbound"
  20. - DECODE_IPV4_DGRAM_GT_IPHDR : crowdsourced_ids:"DECODE_IPV4_DGRAM_GT_IPHDR"
  21. - SURICATA TLS invalid record type : crowdsourced_ids:"SURICATA TLS invalid record type"
  22. - ET MALWARE OSX/Shlayer CnC Activity M4 : crowdsourced_ids:"ET MALWARE OSX/Shlayer CnC Activity M4"
  23. - DECODE_TCPOPT_EXPERIMENT : crowdsourced_ids:"DECODE_TCPOPT_EXPERIMENT"
  24. - SURICATA STREAM Packet with invalid timestamp : crowdsourced_ids:"SURICATA STREAM Packet with invalid timestamp"
  25. - MALWARE-CNC Win.Trojan.Hancitor outbound cnc connection : crowdsourced_ids:"MALWARE-CNC Win.Trojan.Hancitor outbound cnc connection"
  26. - EVENT_VERSION_NOT_UPPERCASE : crowdsourced_ids:"EVENT_VERSION_NOT_UPPERCASE"
  27. - ET INFO HTTP POST Request to Suspicious *.icu domain : crowdsourced_ids:"ET INFO HTTP POST Request to Suspicious *.icu domain"
  28. - ET INFO DNS Query for Suspicious .icu Domain : crowdsourced_ids:"ET INFO DNS Query for Suspicious .icu Domain"
  29. - ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 : crowdsourced_ids:"ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016"
  30. - ET MALWARE Win32/Ficker Stealer Activity : crowdsourced_ids:"ET MALWARE Win32/Ficker Stealer Activity"
  31. - SURICATA Applayer Protocol detection skipped: crowdsourced_ids:"SURICATA Applayer Protocol detection skipped"
  32. - ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative): crowdsourced_ids:"ET MALWARE Generic - POST To .php w"
  33. - ET MALWARE AZORult Variant.4 Checkin M2 : crowdsourced_ids:"ET MALWARE AZORult Variant.4 Checkin M2"
  34. - MALWARE-CNC Win.Trojan.Azorult outbound connection : crowdsourced_ids:"MALWARE-CNC Win.Trojan.Azorult outbound connection"
  35. - ET MALWARE AZORult v3.2 Server Response M3 : crowdsourced_ids:"ET MALWARE AZORult v3.2 Server Response M3"
  36. - ET MALWARE Win32/AZORult V3.3 Client Checkin M8 : crowdsourced_ids:"ET MALWARE Win32/AZORult V3.3 Client Checkin M8"
  37. - ET MALWARE Win32/AZORult V3.2 Client Checkin M9 : crowdsourced_ids:"ET MALWARE Win32/AZORult V3.2 Client Checkin M9"
  38. - ET MALWARE Win32.Spy/TVRat Checkin : crowdsourced_ids:"ET MALWARE Win32.Spy/TVRat Checkin"
  39. - DECODE_IP_OPTION_SET : crowdsourced_ids:"DECODE_IP_OPTION_SET"
  40. - DECODE_IP4_DST_BROADCAST : crowdsourced_ids:"DECODE_IP4_DST_BROADCAST"
  41. - PSNG_UDP_PORTSWEEP_FILTERED : crowdsourced_ids:"PSNG_UDP_PORTSWEEP_FILTERED"
  42. - DECODE_IP4_SRC_THIS_NET : crowdsourced_ids:"DECODE_IP4_SRC_THIS_NET"
  43. - FILE tracking GIF (1x1 pixel) : crowdsourced_ids:"FILE tracking GIF (1x1 pixel)"
  44. - ARPSPOOF_UNICAST_ARP_REQUEST : crowdsourced_ids:"ARPSPOOF_UNICAST_ARP_REQUEST"
  45. - ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) : crowdsourced_ids:"ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)"
  46. - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : crowdsourced_ids:"ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1"
  47. - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : crowdsourced_ids:"ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2"
  48. - ET MALWARE Sharik/Smoke CnC Beacon 11 : crowdsourced_ids:"ET MALWARE Sharik/Smoke CnC Beacon 11"
  49. - DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED : crowdsourced_ids:"DECODE_ICMP_DST_UNREACH_DST_HOST_PROHIBITED"
  50. - ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download : crowdsourced_ids:"ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download"
  51. - ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response : crowdsourced_ids:"ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response"
  52. - ET MALWARE AZORult v3.3 Server Response M1 :
  53. - ET DNS Query for .su TLD (Soviet Union) Often Malware Related : crowdsourced_ids:"ET DNS Query for .su TLD (Soviet Union) Often Malware Related"
  54. - ET CINS Active Threat Intelligence Poor Reputation IP group 25 : crowdsourced_ids:"ET CINS Active Threat Intelligence Poor Reputation IP group 25"
  55. - PSNG_IP_FILTERED_DECOY_PORTSCAN : crowdsourced_ids:"PSNG_IP_FILTERED_DECOY_PORTSCAN"
  56. - ET MALWARE Possible Malicious Macro DL EXE Feb 2016 : crowdsourced_ids:"ET MALWARE Possible Malicious Macro DL EXE Feb 2016"
  57. - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : crowdsourced_ids:"ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile"
  58. - ET POLICY Cryptocurrency Miner Checkin : crowdsourced_ids:"ET POLICY Cryptocurrency Miner Checkin"
  59. - PUA-OTHER XMRig cryptocurrency mining pool connection attempt : crowdsourced_ids:"PUA-OTHER XMRig cryptocurrency mining pool connection attempt"
  60. - ET POLICY IRC Channel JOIN on non-standard port : crowdsourced_ids:"ET POLICY IRC Channel JOIN on non-standard port"
  61. - ET MALWARE IRC DNS request on non-standard port : crowdsourced_ids:"ET MALWARE IRC DNS request on non-standard port"
  62. - ET MALWARE IRC Private message on non-standard port : crowdsourced_ids:"ET MALWARE IRC Private message on non-standard port"
  63. - ET ADWARE_PUP User-Agent (Mozilla/4.0 (compatible)) : crowdsourced_ids:"ET ADWARE_PUP User-Agent (Mozilla/4.0 (compatible))"
  64. - ET HUNTING SUSPICIOUS IRC - NICK and 3 Letter Country Code : crowdsourced_ids:"ET HUNTING SUSPICIOUS IRC - NICK and 3 Letter Country Code"
  65. - ET HUNTING SUSPICIOUS IRC - NICK and Possible Windows XP/7 : crowdsourced_ids:"ET HUNTING SUSPICIOUS IRC - NICK and Possible Windows XP/7"
  66. - ET HUNTING SUSPICIOUS IRC - NICK and Win : crowdsourced_ids:"ET HUNTING SUSPICIOUS IRC - NICK and Win"
  67. - ET INFO DNS Query for Suspicious .ga Domain : crowdsourced_ids:"ET INFO DNS Query for Suspicious .ga Domain"
  68. - ET INFO Dotted Quad Host DLL Request : crowdsourced_ids:"ET INFO Dotted Quad Host DLL Request"
  69. - ET INFO Packed Executable Download : crowdsourced_ids:"ET INFO Packed Executable Download"
  70. - ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) : crowdsourced_ids:"ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)"
  71. - ET CHAT IRC USER Off-port Likely bot with 0 0 colon checkin : crowdsourced_ids:"ET CHAT IRC USER Off-port Likely bot with 0 0 colon checkin"
  72. - SURICATA Applayer Detect protocol only one direction : crowdsourced_ids:"SURICATA Applayer Detect protocol only one direction"
  73. - ET MALWARE LokiBot User-Agent (Charon/Inferno) : crowdsourced_ids:"ET MALWARE LokiBot User-Agent (Charon/Inferno)"
  74. - ET MALWARE Possible Malicious Macro EXE DL AlphaNumL : crowdsourced_ids:"ET MALWARE Possible Malicious Macro EXE DL AlphaNumL"
  75. - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : crowdsourced_ids:"ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1"
  76. - ET MALWARE LokiBot Request for C2 Commands Detected M1 : crowdsourced_ids:"ET MALWARE LokiBot Request for C2 Commands Detected M1"
  77. - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 : crowdsourced_ids:"ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2"
  78. - ET MALWARE LokiBot Request for C2 Commands Detected M2 : crowdsourced_ids:"ET MALWARE LokiBot Request for C2 Commands Detected M2"
  79. - ET MALWARE LokiBot Checkin : crowdsourced_ids:"ET MALWARE LokiBot Checkin"
  80. - ET MALWARE LokiBot Fake 404 Response : crowdsourced_ids:"ET MALWARE LokiBot Fake 404 Response"
  81. - MALWARE-CNC User-Agent known malicious user-agent string - Win.Trojan.LokiBot : crowdsourced_ids:"MALWARE-CNC User-Agent known malicious user-agent string - Win.Trojan.LokiBot"
  82. - ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain : crowdsourced_ids:"ET INFO DYNAMIC_DNS HTTP Request to a *.sytes.net Domain"
  83. - HI_SERVER_UTF_NORM_FAIL : crowdsourced_ids:"HI_SERVER_UTF_NORM_FAIL"
  84. - EVENT_UNKNOWN_ENCODING : crowdsourced_ids:"EVENT_UNKNOWN_ENCODING"
  85. - ET MALWARE FormBook CnC Checkin (GET) : crowdsourced_ids:"ET MALWARE FormBook CnC Checkin (GET)"
  86. - ET POLICY DNS Query to DynDNS Domain *.serveirc .com : crowdsourced_ids:"ET POLICY DNS Query to DynDNS Domain *.serveirc .com"
  87. - DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED : crowdsourced_ids:"DECODE_ICMP_DST_UNREACH_ADMIN_PROHIBITED"
  88. - STREAM5_DATA_AFTER_RST_RCVD : crowdsourced_ids:"STREAM5_DATA_AFTER_RST_RCVD"
  89. - ET DROP Spamhaus DROP Listed Traffic Inbound group 19 : crowdsourced_ids:"ET DROP Spamhaus DROP Listed Traffic Inbound group 19"
  90. - ET DROP Spamhaus DROP Listed Traffic Inbound group 20 : crowdsourced_ids:"ET DROP Spamhaus DROP Listed Traffic Inbound group 20"
  91. - ET DROP Spamhaus DROP Listed Traffic Inbound group 29 : crowdsourced_ids:"ET DROP Spamhaus DROP Listed Traffic Inbound group 29"
  92. - SURICATA STREAM ESTABLISHED SYNACK resend with different seq : crowdsourced_ids:"SURICATA STREAM ESTABLISHED SYNACK resend with different seq"
  93. - ET INFO EXE - Served Attached HTTP : crowdsourced_ids:"ET INFO EXE - Served Attached HTTP"
  94. - SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) : crowdsourced_ids:"SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)"
  95. - ET MALWARE Trojan Related Lame Updater User-Agent : crowdsourced_ids:"ET MALWARE Trojan Related Lame Updater User-Agent"
  96. - ET ADWARE_PUP Unknown Malware patchlist.xml Request : crowdsourced_ids:"ET ADWARE_PUP Unknown Malware patchlist.xml Request"
  97. - HI_CLIENT_ASCII : crowdsourced_ids:"HI_CLIENT_ASCII"
  98. - ET MALWARE JS/Nemucod.M.gen downloading EXE payload : crowdsourced_ids:"ET MALWARE JS/Nemucod.M.gen downloading EXE payload"
  99. - ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01 : crowdsourced_ids:"ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01"
  100. - ET MALWARE Phorpiex CnC Domain in DNS Query : crowdsourced_ids:"ET MALWARE Phorpiex CnC Domain in DNS Query"
  101. - ET DNS Query to a *.top domain - Likely Hostile : crowdsourced_ids:"ET DNS Query to a *.top domain - Likely Hostile"
  102. - ET INFO HTTP Request to a *.top domain : crowdsourced_ids:"ET INFO HTTP Request to a *.top domain"
  103. - ET POLICY External IP Lookup Attempt To Wipmania : crowdsourced_ids:"ET POLICY External IP Lookup Attempt To Wipmania"
  104. - ET HUNTING Possible EXE Download From Suspicious TLD : crowdsourced_ids:"ET HUNTING Possible EXE Download From Suspicious TLD"
  105. - ET DNS Query for .to TLD : crowdsourced_ids:"ET DNS Query for .to TLD"
  106. - ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related : crowdsourced_ids:"ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related"
  107. - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : crowdsourced_ids:"ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz"
  108. - HI_CLIENT_UNBOUNDED POST : crowdsourced_ids:"HI_CLIENT_UNBOUNDED POST"
  109. - ET MALWARE Andromeda Checkin : crowdsourced_ids:"ET MALWARE Andromeda Checkin"
  110. - ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0) : crowdsourced_ids:"ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)"
  111. - ET MALWARE Win32.Sality-GR Checkin : crowdsourced_ids:"ET MALWARE Win32.Sality-GR Checkin"
  112. - FILEEXT JPG file claimed : crowdsourced_ids:"FILEEXT JPG file claimed"
  113. - ET MALWARE Win32/Pykspa.C Public IP Check : crowdsourced_ids:"ET MALWARE Win32/Pykspa.C Public IP Check"
  114. - ET POLICY IP Check Domain (showmyipaddress .com in HTTP Host) : crowdsourced_ids:"ET POLICY IP Check Domain (showmyipaddress .com in HTTP Host)"
  115. - ET POLICY IP Check Domain (whatismyip in HTTP Host) : crowdsourced_ids:"ET POLICY IP Check Domain (whatismyip in HTTP Host)"
  116. - ET INFO Observed DNS Query to .biz TLD : crowdsourced_ids:"ET INFO Observed DNS Query to .biz TLD"
  117. - ET INFO Observed DNS Query to .work TLD : crowdsourced_ids:"ET INFO Observed DNS Query to .work TLD"
  118. - ET INFO HTTP Request to Suspicious *.work Domain : crowdsourced_ids:"ET INFO HTTP Request to Suspicious *.work Domain"
  119. - SMTP_COMMAND_OVERFLOW : crowdsourced_ids:"SMTP_COMMAND_OVERFLOW"
  120. - ET MALWARE Backdoor.Win32.Pushdo.s Checkin : crowdsourced_ids:"ET MALWARE Backdoor.Win32.Pushdo.s Checkin"
  121. - ET MALWARE Pushdo.S CnC response : crowdsourced_ids:"ET MALWARE Pushdo.S CnC response"
  122. - SMTP_UNKNOWN_CMD : crowdsourced_ids:"SMTP_UNKNOWN_CMD"
  123. - ET MALWARE Known Sinkhole Response Kryptos Logic : crowdsourced_ids:"ET MALWARE Known Sinkhole Response Kryptos Logic"
  124. - SURICATA STREAM FIN1 FIN with wrong seq : crowdsourced_ids:"SURICATA STREAM FIN1 FIN with wrong seq"
  125. - ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2. : crowdsourced_ids:"ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2."
  126. - ET POLICY Unsupported/Fake Windows NT Version 5.0 : crowdsourced_ids:"ET POLICY Unsupported/Fake Windows NT Version 5.0"
  127. - ET MALWARE Wapack Labs Sinkhole DNS Reply : crowdsourced_ids:"ET MALWARE Wapack Labs Sinkhole DNS Reply"
  128. - SURICATA HTTP unable to match response to request : crowdsourced_ids:"SURICATA HTTP unable to match response to request"
  129. - ET INFO BitNinja IO Security Check : crowdsourced_ids:"ET INFO BitNinja IO Security Check"
  130. - ET DNS Query for .cc TLD : crowdsourced_ids:"ET DNS Query for .cc TLD"
  131. - ET ADWARE_PUP Win32/Toolbar.CrossRider.A Checkin : crowdsourced_ids:"ET ADWARE_PUP Win32/Toolbar.CrossRider.A Checkin"
  132. - ET HUNTING Suspicious User Agent (_) : crowdsourced_ids:"ET HUNTING Suspicious User Agent (_)"
  133. - ET MALWARE Zalupko/Koceg/Mandaph HTTP Checkin (2) : crowdsourced_ids:"ET MALWARE Zalupko/Koceg/Mandaph HTTP Checkin (2)"
  134. - SSL_INVALID_CLIENT_HELLO : crowdsourced_ids:"SSL_INVALID_CLIENT_HELLO"
  135. - MALWARE-OTHER Win.Adware.Dlhelper outbound connection detected : crowdsourced_ids:"MALWARE-OTHER Win.Adware.Dlhelper outbound connection detected"
  136. - SURICATA STREAM ESTABLISHED packet out of window : crowdsourced_ids:"SURICATA STREAM ESTABLISHED packet out of window"
  137. - SURICATA STREAM ESTABLISHED invalid ack : crowdsourced_ids:"SURICATA STREAM ESTABLISHED invalid ack"
  138. - SURICATA STREAM Packet with invalid ack : crowdsourced_ids:"SURICATA STREAM Packet with invalid ack"
  139. - ET INFO Suspicious Windows NT version 0 User-Agent : crowdsourced_ids:"ET INFO Suspicious Windows NT version 0 User-Agent"
  140. - ET HUNTING Double User-Agent (User-Agent User-Agent) : crowdsourced_ids:"ET HUNTING Double User-Agent (User-Agent User-Agent)"
  141. - ET ADWARE_PUP Win32/Adware.Adposhel.A Checkin M6 : crowdsourced_ids:"ET ADWARE_PUP Win32/Adware.Adposhel.A Checkin M6"
  142. - ET POLICY Dropbox.com Offsite File Backup in Use : crowdsourced_ids:"ET POLICY Dropbox.com Offsite File Backup in Use"
  143. - STREAM5_SYN_ON_EST : crowdsourced_ids:"STREAM5_SYN_ON_EST"
  144. - STREAM5_BAD_RST : crowdsourced_ids:"STREAM5_BAD_RST"
  145. - STREAM5_DATA_ON_CLOSED : crowdsourced_ids:"STREAM5_DATA_ON_CLOSED"
  146. - STREAM5_DATA_AFTER_RESET : crowdsourced_ids:"STREAM5_DATA_AFTER_RESET"
  147. - EVENT_RESPONSE_WO_REQUEST : crowdsourced_ids:"EVENT_RESPONSE_WO_REQUEST"
  148. - ET POLICY RDP connection confirm : crowdsourced_ids:"ET POLICY RDP connection confirm"
  149. - ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Inbound) : crowdsourced_ids:"ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Inbound)"
  150. - SURICATA STREAM SHUTDOWN RST invalid ack : crowdsourced_ids:"SURICATA STREAM SHUTDOWN RST invalid ack"
  151. - ET POLICY MS Remote Desktop Administrator Login Request : crowdsourced_ids:"ET POLICY MS Remote Desktop Administrator Login Request"
  152. - SURICATA STREAM suspected RST injection : crowdsourced_ids:"SURICATA STREAM suspected RST injection"
  153. - SURICATA STREAM 3way handshake wrong seq wrong ack : crowdsourced_ids:"SURICATA STREAM 3way handshake wrong seq wrong ack"
  154. - ET JA3 Hash - Possible Malware - RigEK : crowdsourced_ids:"ET JA3 Hash - Possible Malware - RigEK"
  155. - ET JA3 Hash - Possible Malware - Various Eitest : crowdsourced_ids:"ET JA3 Hash - Possible Malware - Various Eitest"
  156. - ET SCAN NETWORK Incoming Masscan detected : crowdsourced_ids:"ET SCAN NETWORK Incoming Masscan detected"
  157. - ET MALWARE DNS Reply Sinkhole - Anubis/BitSight - 35.205.61.67 : crowdsourced_ids:"ET MALWARE DNS Reply Sinkhole - Anubis/BitSight - 35.205.61.67"
  158. - ET INFO DNS Query for Suspicious .gq Domain : crowdsourced_ids:"ET INFO DNS Query for Suspicious .gq Domain"
  159. - ET HUNTING Request to .GQ Domain with Minimal Headers : crowdsourced_ids:"ET HUNTING Request to .GQ Domain with Minimal Headers"
  160. - ET POLICY GNU/Linux YUM User-Agent Outbound likely related to package management : crowdsourced_ids:"ET POLICY GNU/Linux YUM User-Agent Outbound likely related to package management"
  161. - ET CHAT Facebook Chat using XMPP : crowdsourced_ids:"ET CHAT Facebook Chat using XMPP"
  162. - ET POLICY Dropbox Client Broadcasting : crowdsourced_ids:"ET POLICY Dropbox Client Broadcasting"
  163. - ET MALWARE Unknown - Loader - Check .exe Updated : crowdsourced_ids:"ET MALWARE Unknown - Loader - Check .exe Updated"
  164. - ET CHAT Skype VOIP Checking Version (Startup) : crowdsourced_ids:"ET CHAT Skype VOIP Checking Version (Startup)"
  165. - ET CHAT Skype User-Agent detected : crowdsourced_ids:"ET CHAT Skype User-Agent detected"
  166. - ET POLICY Dropbox DNS Lookup - Possible Offsite File Backup in Use : crowdsourced_ids:"ET POLICY Dropbox DNS Lookup - Possible Offsite File Backup in Use"
  167. - ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server) : crowdsourced_ids:"ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)"
  168. - POP_UNKNOWN_RESP : crowdsourced_ids:"POP_UNKNOWN_RESP"
  169. - POP_UNKNOWN_CMD : crowdsourced_ids:"POP_UNKNOWN_CMD"
  170. - OS-OTHER Bash CGI environment variable injection attempt : crowdsourced_ids:"OS-OTHER Bash CGI environment variable injection attempt"
  171. - ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers : crowdsourced_ids:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers"
  172. - ET WEB_SERVER CURL Command Specifying Output in HTTP Headers : crowdsourced_ids:"ET WEB_SERVER CURL Command Specifying Output in HTTP Headers"
  173. - ET WEB_SERVER WGET Command Specifying Output in HTTP Headers : crowdsourced_ids:"ET WEB_SERVER WGET Command Specifying Output in HTTP Headers"
  174. - ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning : crowdsourced_ids:"ET SCAN GET with HTML tag in start of URI seen with PHPMyAdmin scanning"
  175. - ET EXPLOIT Possible ZyXELs ZynOS Configuration Download Attempt (Contains Passwords) : crowdsourced_ids:"ET EXPLOIT Possible ZyXELs ZynOS Configuration Download Attempt (Contains Passwords)"
  176. - GPL WEB_SERVER 403 Forbidden : crowdsourced_ids:"GPL WEB_SERVER 403 Forbidden"
  177. - ET WEB_SERVER Muieblackcat scanner : crowdsourced_ids:"ET WEB_SERVER Muieblackcat scanner"
  178. - ET POLICY Possible Web Crawl using Wget : crowdsourced_ids:"ET POLICY Possible Web Crawl using Wget"
  179. - ET MALWARE Double HTTP/1.1 Header Inbound - Likely Hostile Traffic : crowdsourced_ids:"ET MALWARE Double HTTP/1.1 Header Inbound - Likely Hostile Traffic"
  180. - EXPLOIT-KIT Magnitude exploit kit Internet Explorer exploit attempt : crowdsourced_ids:"EXPLOIT-KIT Magnitude exploit kit Internet Explorer exploit attempt"
  181. - EXPLOIT-KIT Magnitude exploit kit Microsoft Internet Explorer Payload request : crowdsourced_ids:"EXPLOIT-KIT Magnitude exploit kit Microsoft Internet Explorer Payload request"
  182. - EXPLOIT-KIT Multiple exploit kit payload download : crowdsourced_ids:"EXPLOIT-KIT Multiple exploit kit payload download"
  183. - POLICY-OTHER Adobe ColdFusion admin interface access attempt : crowdsourced_ids:"POLICY-OTHER Adobe ColdFusion admin interface access attempt"
  184. - ET EXPLOIT_KIT Unknown Malicious Second Stage Download URI Struct M2 Feb 06 2015 : crowdsourced_ids:"ET EXPLOIT_KIT Unknown Malicious Second Stage Download URI Struct M2 Feb 06 2015"
  185. - ET EXPLOIT_KIT Unknown Malicious Second Stage Download URI Struct Sept 15 2015 : crowdsourced_ids:"ET EXPLOIT_KIT Unknown Malicious Second Stage Download URI Struct Sept 15 2015"
  186. - ET MALWARE Poweliks Clickfraud CnC M4 : crowdsourced_ids:"ET MALWARE Poweliks Clickfraud CnC M4"
  187. - ET MALWARE Possible Windows executable sent when remote host claims to send html content : crowdsourced_ids:"ET MALWARE Possible Windows executable sent when remote host claims to send html content"
  188. - MALWARE-CNC Win.Trojan.ZeusPanda outbound cnc connection : crowdsourced_ids:"MALWARE-CNC Win.Trojan.ZeusPanda outbound cnc connection"
  189. - ET HUNTING Suspicious HTTP Request to .bit domain : crowdsourced_ids:"ET HUNTING Suspicious HTTP Request to .bit domain"
  190. - ET HUNTING SUSPICIOUS Possible Office Doc with Embedded VBA Project (Wide) : crowdsourced_ids:"ET HUNTING SUSPICIOUS Possible Office Doc with Embedded VBA Project (Wide)"
  191. - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : crowdsourced_ids:"ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA"
  192. - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1 : crowdsourced_ids:"ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1"
  193. - ET MALWARE Worm.VBS.ayr CnC command (is-enum-driver) : crowdsourced_ids:"ET MALWARE Worm.VBS.ayr CnC command (is-enum-driver)"
  194. - ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture) : crowdsourced_ids:"ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)"
  195. - ET MALWARE Bladabindi/njRAT CnC Command (ll) : crowdsourced_ids:"ET MALWARE Bladabindi/njRAT CnC Command (ll)"
  196. - ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) : crowdsourced_ids:"ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)"
  197. - MALWARE-CNC Win.Backdoor.Iniduoh variant outbound connection : crowdsourced_ids:"MALWARE-CNC Win.Backdoor.Iniduoh variant outbound connection"
  198. - ET INFO DYNAMIC_DNS Query to 3322.org Domain : crowdsourced_ids:"ET INFO DYNAMIC_DNS Query to 3322.org Domain"
  199. - ET INFO Observed DNS Query to .myq-see .com DDNS Domain : crowdsourced_ids:"ET INFO Observed DNS Query to .myq-see .com DDNS Domain"
  200. - ET MALWARE Worm.VBS.ayr Checkin 2 : crowdsourced_ids:"ET MALWARE Worm.VBS.ayr Checkin 2"
  201. - ET POLICY DNS Query to DynDNS Domain *.ddns .net : crowdsourced_ids:"ET POLICY DNS Query to DynDNS Domain *.ddns .net"
  202. - ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords) : crowdsourced_ids:"ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)"
  203. - ET DNS Query to a *.pw domain - Likely Hostile : crowdsourced_ids:"ET DNS Query to a *.pw domain - Likely Hostile"
  204. - ET HUNTING Request to .XYZ Domain with Minimal Headers : crowdsourced_ids:"ET HUNTING Request to .XYZ Domain with Minimal Headers"
  205. - EXPLOIT-KIT Multiple exploit kit single digit exe detection : crowdsourced_ids:"EXPLOIT-KIT Multiple exploit kit single digit exe detection"
  206. - ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) : crowdsourced_ids:"ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)"
  207. - ET MALWARE Potential Dridex.Maldoc Minimal Executable Request : crowdsourced_ids:"ET MALWARE Potential Dridex.Maldoc Minimal Executable Request"
  208. - MALWARE-CNC Win.Downloader.TeamBot outbound cnc connection : crowdsourced_ids:"MALWARE-CNC Win.Downloader.TeamBot outbound cnc connection"
  209. - ET MALWARE Vidar/Arkei Stealer Client Data Upload : crowdsourced_ids:"ET MALWARE Vidar/Arkei Stealer Client Data Upload"
  210. - ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil : crowdsourced_ids:"ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil"
  211. - ATTACK [PTsecurity] Mismatch URI and Host header. Possible Squid cache poisoning : crowdsourced_ids:"ATTACK [PTsecurity] Mismatch URI and Host header. Possible Squid cache poisoning"
  212. - ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) : crowdsourced_ids:"ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)"
  213. - ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) : crowdsourced_ids:"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)"
  214. - ET POLICY Data POST to an image file (jpg) : crowdsourced_ids:"ET POLICY Data POST to an image file (jpg)"
  215. - ET MALWARE Fareit/Pony Downloader Checkin 3 : crowdsourced_ids:"ET MALWARE Fareit/Pony Downloader Checkin 3"
  216. - ET MALWARE Fareit/Pony Downloader Checkin 2 : crowdsourced_ids:"ET MALWARE Fareit/Pony Downloader Checkin 2"
  217. - ET MALWARE Generic gate[.].php GET with minimal headers : crowdsourced_ids:"ET MALWARE Generic gate[.].php GET with minimal headers"
  218. - ET HUNTING Suspicious GET To gate.php with no Referer : crowdsourced_ids:"ET HUNTING Suspicious GET To gate.php with no Referer"
  219. - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) : crowdsourced_ids:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)"
  220. - ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad : crowdsourced_ids:"ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad"
  221. - ET MALWARE Trojan Generic - POST To gate.php with no referer : crowdsourced_ids:"ET MALWARE Trojan Generic - POST To gate.php with no referer"
  222. - ET HUNTING Telegram API Certificate Observed : crowdsourced_ids:"ET HUNTING Telegram API Certificate Observed"
  223. - ET MALWARE Ransomware/Cerber Checkin 2 : crowdsourced_ids:"ET MALWARE Ransomware/Cerber Checkin 2"
  224. - ET POLICY DNS Query to a *.ngrok domain (ngrok.io) : crowdsourced_ids:"ET POLICY DNS Query to a *.ngrok domain (ngrok.io)"
  225. - ET MALWARE Sekhmet Ransomware CnC Activity : crowdsourced_ids:"ET MALWARE Sekhmet Ransomware CnC Activity"
  226. - ET MALWARE DiamondFox HTTP Post CnC Checkin M3: crowdsourced_ids:"ET MALWARE DiamondFox HTTP Post CnC Checkin M3"
  227. - ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon : crowdsourced_ids:"ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon"
  228. - ET MALWARE DNSBin Demo (requestbin .net) - Data Exfil: crowdsourced_ids:"ET MALWARE DNSBin Demo (requestbin .net) - Data Exfil"
  229. - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M3 : crowdsourced_ids:"ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M3"
  230. - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : crowdsourced_ids:"ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response"
  231. - ET MALWARE GCleaner Downloader Activity M1: crowdsourced_ids:"ET MALWARE GCleaner Downloader Activity M1"
  232. - MALWARE-CNC DNS Fast Flux attempt: crowdsourced_ids:"MALWARE-CNC DNS Fast Flux attempt"
  233. - ET MALWARE Possible NanoCore C2 60B : crowdsourced_ids:"ET MALWARE Possible NanoCore C2 60B"
  234. - ET HUNTING Observed POST to xsph .ru Domain : crowdsourced_ids:"ET HUNTING Observed POST to xsph .ru Domain"
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!