Please, wait...

26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] b3:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T4a2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 64dff1fbeab7… — Score 100/100 — Sample 79e3317a07b1…","description":"Malicious verdict for sandbox report 64dff1fbeab7…. Threat score 100/100. 2 malicious and 12 suspicious behavioral indicators across 162 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca/64dff1fbeab7dc252b0e56a6","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca"],"about":{"@type":"SoftwareApplication","name":"suricata.rules","applicationCategory":"ASCII text, with very long lines","identifier":"79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":2,"suspicious":12,"totalSignatures":162},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T67ea,Found string - ; pcre:"/^User-Agent\x3a Downloader \d\.\d\r?$/Hm"; reference:url www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=PUA:Win32/LoadMoney; classtype:pup-activity; sid:2024260; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit attack_target Client_Endpoint created_at 2017_04_27 deployment Perimeter former_category ADWARE_PUP malware_family Loadmoney performance_impact Low signature_severity Minor tag Loadmoney updated_at 2017_04_27;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyspotter.com Access Likely Spyware"; flow: to_server,established; content:"Host|3a|"; nocase; http_header; content:".oemji.com"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001539; classtype:pup-activity; sid:2001539; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2017_05_11;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP InstallCore Variant CnC Checkin"; flow:established,to_server; uril; Source: "suricata.bin") Found string - dia Related Media Manager Spyware Checkin"; flow:established,to_server; http.user_agent; content:"MM|20|"; startswith; pcre:"/^MM \d\.\d+$/"; classtype:pup-activity; sid:2013388; rev:6; metadata:created_at 2011_08_10, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Suspicious User-Agent (go-diva)"; flow:to_server,established; http.user_agent; content:"go-diva"; reference:url,pcthreat.com/parasitebyid-8835en.html; classtype:pup-activity; sid:2013452; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_08_24, deployment Perimeter, former_category ADWARE_PUP, signature_severity Major, tag User_Agent, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP UBar Trojan/Adware Checkin 1"; flow:established,to_server; http.uri; content:"?gname="; content:"&pid="; content:"&m="; http.header; content:"|20|from|3a 20|http|3a|//www.bsalsa.com/ EmbeddedWB|20|"; reference:md5,81a119f7f476; Source: "suricata.bin"), Found string - ce="; content:"&event="; content:"&implementation_id="; content:"user_id="; content:"&useragent="; content:"&sgn="; content:"&subid2="; content:"&ts="; http.header_names; content:!"Referer"; content:!"Accept"; reference:md5 d15069e44ec849ab26bcefffe6867f10; reference:md5 4ececc2f027a096c2100ec1125d0d151; classtype:pup-activity; sid:2022893; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit attack_target Client_Endpoint created_at 2016_06_13 deployment Perimeter former_category ADWARE_PUP malware_family MSIL_Adload signature_severity Major tag Adware tag c2 updated_at 2020_08_31 mitre_tactic_id TA0011 mitre_tactic_name Command_And_Control mitre_technique_id T1041 mitre_technique_name Exfiltration_Over_C2_Channel;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP LoadMoney Checkin 5"; flow:established,to_server; http.method; content:"POST"; http.user_agent; pcre:"/^Downloader\s\d+\.\d+$/"; content:"Downloader|20|"; startswith; http.request_body; content:"|0a; Source: "suricata.bin") Found string - er_names; content:!"Referer|0d 0a|"; content:!"Accept-"; reference:md5 76e54deb6f81edd6b47c854c847d590d; classtype:pup-activity; sid:2021401; rev:5; metadata:attack_target Client_Endpoint created_at 2015_07_10 deployment Perimeter former_category ADWARE_PUP signature_severity Major tag c2 updated_at 2020_10_12 mitre_tactic_id TA0011 mitre_tactic_name Command_And_Control mitre_technique_id T1041 mitre_technique_name Exfiltration_Over_C2_Channel;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Loadmoney User Agent"; flow:established,to_server; http.user_agent; content:"Downloader|20|"; startswith; fast_pattern; pcre:"/^Downloader \d\.\d$/"; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=PUA:Win32/LoadMoney; classtype:pup-activity; sid:2024249; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_03_14, deployment Perimeter, former_category ADWARE_PUP, malware_family Loadmoney, p; Source: "suricata.bin") Found string - stik Botnet Download Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.user_agent; pcre:"/^(?:curl|wget)/i"; http.uri; content:"/dk"; startswith; fast_pattern; pcre:"/^[0-9]{2}$/R"; http.host; pcre:"/^\d{1 3}\.\d{1 3}\.\d{1 3}\.\d{1 3}$/"; http.header_names; content:!"Referer"; reference:url,www.lacework.com/blog/muhstik-takes-aim-at-confluence-cve-2021-26084/; reference:md5,898b3dc58bc5d05d3034a1c259b5a915; classtype:trojan-activity; sid:2033916; rev:1; metadata:created_at 2021_09_09, former_category ATTACK_RESPONSE, updated_at 2021_09_09;)alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Obfuscated Batch Script Inbound M1"; flow:established,from_server; content:"|2c 31 25 25 27 3a 7e|"; content:"|2c 31 25 25 27 3a 7e|"; distance:0; pcre:"/[-\d]{1 4}(?:\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}/R"; reference:md5,abd0a49fda67547639eeaced7955a01a; classtype:misc-attack; sid:2034183; rev:1; metadata:created_at 2021_10_13, former_category ATTACK_RESPONSE, update; Source: "suricata.bin"), Found string - y (msg:"ET COINMINER CoinHive In-Browser Miner Detected"; flow:established,from_server; file_data; content:"coinhive.min.js"; nocase; fast_pattern; content:"start"; nocase; distance:0; content:"script"; content:"var"; distance:0; pcre:"/^\s*(?P[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^$]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(?:\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?$\s*\x3b\s+(?P=var)\s*\.\s*start/Ri"; classtype:coin-mining; sid:2024721; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2017_09_18, deployment Perimeter, former_category COINMINER, performance_impact Moderate, signature_severity Minor, updated_at 2018_05_08;)alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET COINMINER Random Hash Pascalcoin Miner Checkin"; flow:established,to_server; content:"{|22|params|22|:[|22|rhminer/"; depth:20; classtype:coin-mining; sid:2026750; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_; Source: "suricata.bin"), Found string - /find-new-web-bot-jembot.html?m=1; classtype:web-application-activity; sid:2014615; rev:3; metadata:created_at 2012_04_18, updated_at 2012_04_18;)# alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS FedEX Spam Inbound"; flow:established,to_server; content:"name=|22|FEDEX"; nocase; content:".zip|22|"; within:47; nocase; pcre:"/name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0 42}\.zip\x22/i"; classtype:trojan-activity; sid:2014827; rev:2; metadata:created_at 2012_05_30, updated_at 2012_05_30;)# alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS Post Express Spam Inbound"; flow:established,to_server; content:"name=|22|Post_Express_Label_"; nocase; content:".zip|22|"; within:15; nocase; pcre:"/name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0 10}\.zip\x22/i"; classtype:trojan-activity; sid:2014829; rev:1; metadata:created_at 2012_05_30, updated_at 2012_05_30;)# alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET CURRENT_EVENTS webshell used In timthumb attacks GIF98a 16129; Source: "suricata.bin") Found string - lished from_server; file_data; content:"|22 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 22|+"; pcre:"/^(?P.{1,10})\.\_\_\$\+(?P=var)\.\_\_\_\+(?P=var)\.\$\_\$\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\$\+(?P=var)\.\$\_\$\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\_\+(?P=var)\.\$\_\$\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\$\_\+(?P=var)\.\$\_\_\+\x22\.\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\_\+(?P=var)\.\$\_\_\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\$\+(?P=var)\.\$\_\_\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\$\+(?P=var)\.\$\_\_\+\x22/R"; classtype:trojan-activity; sid:2018286; rev:3; metadata:created_at 2014_03_18 updated_at 2014_03_18;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Deep Panda WateringHole Related URI Struct"; flow:established,to_server; content:".php?v=webhp"; fast_pattern:only; http_uri; nocase; classtype:trojan-activity; sid:2018348; rev:3; metadata:created_at 2014_04_02, updated_at 2014_04_02;)# alert h; Source: "suricata.bin") Found string - ; rev:2; metadata:created_at 2014_11_20 updated_at 2014_11_20;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Magnitude Flash Payload"; flow:established,to_server; urilen:34; content:"/?"; http_uri; depth:2; fast_pattern; content:!"User-Agent"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; pcre:"/^\/\?[a-f0-9]{32}$/U"; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(?:\x3a\d{1,5})?\r\n/H"; classtype:exploit-kit; sid:2019800; rev:2; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SoakSoak Malware GET request"; flow:established,to_server; content:"GET"; http_method; content:"/xteas/code"; http_uri; fast_pattern:only; pcre:"/^Host\x3a[^\r\n]+soaksoak\.ru/Hmi"; pcre:"/^\/xteas\/code$/U"; reference:url,blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpress-websites.html; classtype:trojan-activity; sid:2019939; rev:3; metadata:; Source: "suricata.bin"), Found string - ntent:"UPS"; nocase; within:11; content:".zip|22|"; within:74; nocase; pcre:"/name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0 69}\.zip\x22/i"; classtype:trojan-activity; sid:2014828; rev:3; metadata:created_at 2012_05_30, former_category CURRENT_EVENTS, updated_at 2017_12_11;)# alert tcp $EXTERNAL_NET [139,445] -> $HOME_NET any (msg:"ET CURRENT_EVENTS CERTEGO Possible JScript Coming Over SMB v2"; flow:established,from_server; content:"|FE|SMB"; offset:4; depth:8; content:"|08 00|"; distance:8; within:10; content:"var"; distance:48; fast_pattern; content:"="; distance:0; isdataat:2,relative; reference:url,twitter.com/SettiDavide89/status/970965983228723201; reference:url,www.certego.net/it/news/quant-url/; classtype:trojan-activity; sid:2025409; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_03_06, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Moderate, signature_severity Major, updated_at 2018_03_07;); Source: "suricata.bin"), Found string - content:"var"; pcre:"/^\s*(?P[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1 300}(?P=worker)\s*=\s*document\.getElementById$[\x22\x27](?P=worker)[\x22\x27]$\x3b.{1 300}\.addEventListener$[\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(?P[A-Za-z0-9_-]{1,20}).{0 300}(?P=worker)(?P(\.\w{1,20})+)\s*=\s*\d+\x3b.{1 300}function\s*(?P=callback0)\([^$]+\)\s*\{\s*.{1 300}\.requestAnimationFrame$(?P[A-Za-z0-9_-]{1,20})$\x3b.{1 300}function\s*(?P[A-Za-z0-9_-]{1,20})\s*\{\s*.{0 100}for\s*$let\s*(?P[A-Za-z0-9_-]{1,20})\s*=\s*\d{1 8}\s*\x3b\s*(?P=gc_counter)\s*(?:<|>)\s*(?:0x)?\d{2 }\s*\x3b\s*(?P=gc_counter)(?:\+{2}|-{2})\s*$\s*.{1 300}function\s*(?P=callback)$[^$]+\)\s*\{\s*.{1 300}(?P=garbagecollector)\s*\x3b\s*.{1 300}$(?P=worker)(?P=worker_ext)$/Rs"; content:"document.getElementById|28|"; content:".addEventListener|28 22|DOMNodeInserted"; content:"window.requestAnimationFrame"; fast_pattern; reference:cve,2021-1879; classtype:attempted-admin;; Source: "suricata.bin"), Found string - A-Za-z0-9_-]{1,20})\s*=\s*$\{\}$\.__proto__\x3b.{1,300}(?P=obj_proto)\.__defineGetter__$[\x22\x27](?P=x_prop)[\x22\x27],\s*Error\.prototype\.toString$\x3b\s*(?:\/\/[\w\s_-]+)?(?:\/\/\s*[^\r\n]+\r\n)?(?P=obj_proto)\.__defineGetter__\([\x22\x27](?P[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(?P=obj_proto)\.(?P=message_proto)\x3b.{1,300}(?P=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(?P=opt)/Rs"; content:"|28 7b 7d 29|.__proto__"; fast_pattern; content:"Error.prototype.toString"; reference:cve 2019-0568; classtype:attempted-admin; sid:2033775; rev:2; metadata:attack_target Client_Endpoint created_at 2021_08_24 cve CVE_2019_0568 deployment Perimeter former_category EXPLOIT confidence Medium signature_severity Major tag Exploit updated_at 2021_08_24;)alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Edge Chakra - InlineArrayPush Type Confusion Inbound M1 (CVE-2018-8617)"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"function"; pcre:; Source: "suricata.bin"), Found string - k_target Client_Endpoint, created_at 2021_08_25, cve CVE_2018_8617, deployment Perimeter, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_08_25;)alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Edge Chakra - NewScObjectNoCtor InitProtoType Confusion Inbound (CVE-2019-0567)"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"function"; pcre:"/^\s*(?P[\w-]{1,20})$(?P[\w-]{1,20})\s* \s*(?P[\w-]{1,20})\s* \s*(?P[\w-]{1,20})$.{1 300}(?P=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(?P=tmp_obj)\}\x3b\s*(?P=obj1)\.\w+\s*=\s*(?P=value)\x3b.{1 300}var\s*(?P=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s* \s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*$\s*var\s*(?P[\w-]{1,20})\s*=\s*\d{1 8}\s*\x3b\s*(?P=counter)\s*(?:<|>)\s*(?:0x)?\d{2 }\s*\x3b\s*(?P=counter)(?:\+{2}|-{2})$\s*\{\s*(?P=func_a)$(?P=obj1)\s* \s*(\x22{2}|\x27{2})\s* \s*(\x22{2}|\x27{2})$\x3b.{1 300}(?P=func_a)\((?P=obj1)\s* \s*(?P=obj1)\s* \s*\d+; Source: "suricata.bin") Found string - \.\d{8 }.{1 300}eval\((?P=obj1)\./Rs"; content:" = |7b|__proto__|3a|"; fast_pattern; content:"eval|28|"; reference:cve,2019-0567; classtype:attempted-admin; sid:2033783; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_08_25, cve CVE_2019_0567, deployment Perimeter, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_08_25;)alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Prestashop Orderfiles Module Arbitrary File Upload"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"/index.php"; startswith; nocase; content:"module=orderfiles"; nocase; content:"controller=filesmanager"; nocase; fast_pattern; http.request_body; content:"addfile"; nocase; content:"file|5b|"; nocase; classtype:attempted-admin; sid:2033826; rev:1; metadata:attack_target Server, created_at 2021_08_27, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_08_27;)alert http any a; Source: "suricata.bin"), Found string - metadata:affected_product Web_Server_Applications, attack_target Networking_Equipment, created_at 2021_09_21, cve CVE_2020_3580, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2021_09_21;)alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Edge Chakra - InlineArrayPush Type Confusion Inbound M2 (CVE-2018-8617)"; flow:established,from_server; file_data; content:"function"; pcre:"/^\s*(?P[\w\-]{1,20})$(?P[\w\-]{1,20})\s* \s*(?P[\w\-]{1,20}).{1 300}(?P=obj_1)\.(?P[\w\-]{1,20})\s*=\s*\d+(?:\.\d+)?.{1 300}?(?P=obj_2)\.pop\($.{1 300}?(?P=obj_1)\.(?P[\w\-]{1,20})\s*=\s*\d+(?:\.\d+)?.{1 500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1 500}var\s*(?P[\w\-]{1,20})\s*=\s*\{\s*(?P=prop_1)\s*\x3a\s*\d+(?:\.\d+)?\s* \s*(?:(?P=prop_2)\s*\x3a\s*\d+(?:\.\d+)?|(?P=prop_2)\s*\x3a\s*\d+(?:\.\d+)?\s* \s*(?P=prop_1)\s*\x3a\s*\d+(?:\.\d+)).{1 500}(?P=func_a)\(\s*(?:(?P=obj_3)\s* \s*new\s*Objec; Source: "suricata.bin") Found string - um signature_severity Major updated_at 2022_12_15;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Observed Mirai/Gafgyt Post Brute Force Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/fuckyou/xd."; startswith; fast_pattern; http.user_agent; content:"wget/"; startswith; nocase; http.host; pcre:"/^\d{1 3}\.\d{1 3}\.\d{1 3}\.\d{1 3}$/"; threshold:type both,track by_src, count 30, seconds 60; reference:url,isc.sans.edu/diary/rss/29304; reference:md5,512d5c2ba6b14f732061fc2f28a72f72; classtype:misc-attack; sid:2042956; rev:1; metadata:attack_target Linux_Unix, created_at 2022_12_16, deployment Perimeter, former_category EXPLOIT, malware_family Mirai, signature_severity Major, updated_at 2022_12_16; target:src_ip;)alert http any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)"; flow:established,to_server; http.method; content:"POST"; http.u; Source: "suricata.bin"), Found string - -talks-at-nato-summit; reference:cve,2023-36884; classtype:attempted-admin; sid:2046810; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_07_12, cve CVE_2023_36884, deployment Perimeter, former_category EXPLOIT, performance_impact Low, confidence High, signature_severity Major, tag Storm_0978, updated_at 2023_07_12; target:src_ip;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2"; flow:established,to_server; flowbits:isset,ET.CVE-2023-36884.Storm-0978; http.method; content:"GET"; http.uri; content:"/MSHTML_"; startswith; content:".asp?d="; fast_pattern; pcre:"/^\d{1 3}\.\d{1 3}\.\d{1 3}\.\d{1 3}_[a-f0-9]{5}_/R"; reference:url,blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit; reference:cve,2023-36884; classtype:attempted-admin; sid:2046811; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_ta; Source: "suricata.bin"), Found string - 030; rev:2; metadata:created_at 2013_06_19, updated_at 2013_06_19;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT NailedPack EK Landing June 18 2013"; flow:established,to_client; file_data; content:"report_and_get_exploits(_0x"; reference:url,www.basemont.com/june_2013_exploit_kit_2; classtype:exploit-kit; sid:2017034; rev:2; metadata:created_at 2013_06_19, updated_at 2013_06_19;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Rawin Exploit Kit Landing URI Struct"; flow:established,to_server; content:".php?"; http_uri; content:"v=1."; http_uri; fast_pattern; content:"."; http_uri; distance:1; within:1; pcre:"/\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.(?:(?:4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1 2})$/U"; classtype:exploit-kit; sid:2017040; rev:2; metadata:created_at 2013_06_22, former_category EXPLOIT_KIT, updated_at 2013_06_22;)alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible Java Applet JNLP applet_ssv_validated in Base64"; flo; Source: "suricata.bin"), Found string - s*?\.\s*?replace\s*?\(/Rsi"; reference:url malware-traffic-analysis.net/2014/08/22/index2.html; reference:url www.malwaresigs.com/2013/10/14/unknown-ek/; classtype:exploit-kit; sid:2018988; rev:2; metadata:created_at 2014_08_23 former_category CURRENT_EVENTS updated_at 2014_08_23;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Malvertising EK Landing URI Sruct Aug 22 2014"; flow:established,to_server; urilen:16; content:"/nhqdxa/eipm.php"; http_uri; fast_pattern:only; reference:url,malware-traffic-analysis.net/2014/08/22/index2.html; reference:url,www.malwaresigs.com/2013/10/14/unknown-ek/; classtype:exploit-kit; sid:2018989; rev:2; metadata:created_at 2014_08_23, former_category CURRENT_EVENTS, updated_at 2014_08_23;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Malvertising EK Payload URI Sruct Aug 22 2014"; flow:established,to_server; urilen:16; content:"/nhqdxa/yztl.php"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; refe; Source: "suricata.bin") Found string - $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Archie EK T2 Landing Struct Nov 20 2014"; flow:established,to_server; urilen:70; content:".html"; http_uri; offset:65; depth:5; pcre:"/^\/[a-f0-9]{64}\.html$/U"; pcre:"/^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a|\r?\n)/Hmi"; classtype:exploit-kit; sid:2019769; rev:4; metadata:created_at 2014_11_21, former_category CURRENT_EVENTS, updated_at 2014_11_21;)# alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Archie EK T2 PD Struct Nov 20 2014"; flow:established,to_server; urilen:68; content:"|2f|"; http_uri; depth:1; content:".js"; http_uri; offset:65; depth:3; pcre:"/^\/[a-f0-9]{64}\.js$/U"; pcre:"/^Referer\x3a[^\r\n]+\x3a\d{1 5}\/[a-f0-9]{64}\.html\r$/Hm"; pcre:"/^Host\x3a\s*?\d{1 3}\.\d{1 3}\.\d{1 3}\.\d{1 3}(?:\x3a|\r?\n)/Hmi"; classtype:exploit-kit; sid:2019768; rev:4; metadata:created_at 2014_11_21, former_category CURRENT_EVENTS, updated_at 2014_11_21;)alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Fiesta EK Landing N; Source: "suricata.bin") Found string - _12_16;)# alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Archie EK T2 Activity Dec 18 2014"; flow:established,to_server; content:"/landing?action="; http_uri; fast_pattern:only; pcre:"/^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a|\r\n)/Hmi"; classtype:exploit-kit; sid:2019973; rev:2; metadata:created_at 2014_12_18, former_category CURRENT_EVENTS, updated_at 2014_12_18;)alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible Sweet Orange redirection Jan 22 2015"; flow:established,from_server; file_data; content:"var theme_customize"; within:19; pcre:"/^\s*?=\s*?[\x22\x27](?!687474703a2f)[^\x22\x27]{0 10}6[^\x22\x27]{0 10}8[^\x22\x27]{0 10}7[^\x22\x27]{0 10}4[^\x22\x27]{0 10}7[^\x22\x27]{0 10}4[^\x22\x27]{0 10}7[^\x22\x27]{0 10}0[^\x22\x27]{0 10}3[^\x22\x27]{0 10}a[^\x22\x27]{0 10}2[^\x22\x27]{0 10}f/Ri"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; noalert; sid:2020291; rev:2; metadata:created_at 2015_01_23, former_category EXPLOIT_KIT, updated_a; Source: "suricata.bin"), Found string - 1"; classtype:exploit-kit; sid:2021046; rev:2; metadata:created_at 2015_05_02 updated_at 2015_05_02;)alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Secondary Landing Page May 01 2015 M1"; flow:from_server,established; file_data; content:"FlashVars"; content:"sh=Y21kIC9jIGVjaG8g"; classtype:exploit-kit; sid:2021047; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;)alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Secondary Landing Page May 01 2015 M2"; flow:from_server,established; file_data; content:"FlashVars"; content:"sh=cG93ZXJzaGVsbC5leGUg"; classtype:exploit-kit; sid:2021048; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Magnitude EK Flash Payload ShellCode Apr 23 2015"; flow:established,from_server; file_data; content:"urlmon.dll|00|http|3a 2f|"; pcre:"/^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f/Rs"; classtype:expl; Source: "suricata.bin") Found string - 08_07 former_category EXPLOIT_KIT updated_at 2014_08_07;)# alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Secondary Landing URI Struct Aug 17 2015"; flow:established,to_server; content:"GET"; http_method; content:".html&"; http_uri; fast_pattern; content:"/"; distance:-47; http_uri; pcre:"/\/\d\/?[A-Z]+\/[a-f0-9]{32}(?:[a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3 }(?:\.\d{3,})?$/U"; classtype:exploit-kit; sid:2021639; rev:2; metadata:created_at 2015_08_17, updated_at 2015_08_17;)# alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Exploit URI Struct Aug 17 2015"; flow:established,to_server; content:"GET"; http_method; content:"Referer|3a|"; http_header; content:"|3a|443/"; distance:0; http_header; fast_pattern; pcre:"/\/\d\/?[A-Z]+\/[a-f0-9]{40}\/$/U"; flowbits:set,ET.CottonCasle.Exploit; classtype:exploit-kit; sid:2021640; rev:2; metadata:created_at 2015_08_17, updated_at 2015_08_17;)# alert http $EXTERNAL_; Source: "suricata.bin"), Found string - 74 65 3b 20 6c 65 66 74 3a 2d 35 30 30 70 78 3b 20 74 6f 70 3a 20 2d 35 30 30 70 78 3b 27 3e 3c 69 66 72 61 6d 65 20 73 72 63 3d 27 68 74 74 70 3a|"; classtype:exploit-kit; sid:2022956; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit attack_target Client_Endpoint created_at 2016_07_11 deployment Perimeter performance_impact Low signature_severity Major tag Redirector updated_at 2016_07_11;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading To EK Jul 10 M1"; flow:established,to_server; content:".js?chebstr=0."; http_uri; pcre:"/\.js\?chebstr=0\.\d+$/U"; classtype:exploit-kit; sid:2022957; rev:2; metadata:created_at 2016_07_11, updated_at 2016_07_11;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Jul 13 2016 2"; flow:established,to_server; content:"POST"; http_method; content:".swf"; nocase; http_header; content:"|4d 61 6e 75 66 75 63 6b|"; nocase; http_client_body; content:"|4d 61 6; Source: "suricata.bin") Found string - T Evil Redirector Leading To EK Jul 30 M1"; flow:established,to_server; content:".js?chbstr=0."; http_uri; pcre:"/\.js\?chbstr=0\.\d+$/U"; classtype:exploit-kit; sid:2022995; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_07_30, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_30;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Aug1 2016"; flow:established,from_server; file_data; content:"|76 61 72 20 68 65 61 64 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 62 6f 64 79 27 29 5b 30 5d 3b 20 76 61 72 20 73 63 72 69 70 74 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 73 63 72 69 70 74 2e 73 72 63 3d 20 22 2f 2f|"; pcre:"/^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*scrip; Source: "suricata.bin")28:T516,Found string - dia Related Media Manager Spyware Checkin"; flow:established,to_server; http.user_agent; content:"MM|20|"; startswith; pcre:"/^MM \d\.\d+$/"; classtype:pup-activity; sid:2013388; rev:6; metadata:created_at 2011_08_10, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Suspicious User-Agent (go-diva)"; flow:to_server,established; http.user_agent; content:"go-diva"; reference:url,pcthreat.com/parasitebyid-8835en.html; classtype:pup-activity; sid:2013452; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_08_24, deployment Perimeter, former_category ADWARE_PUP, signature_severity Major, tag User_Agent, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP UBar Trojan/Adware Checkin 1"; flow:established,to_server; http.uri; content:"?gname="; content:"&pid="; content:"&m="; http.header; content:"|20|from|3a 20|http|3a|//www.bsalsa.com/ EmbeddedWB|20|"; reference:md5,81a119f7f476; Source: "suricata.bin"), Found string - ce="; content:"&event="; content:"&implementation_id="; content:"user_id="; content:"&useragent="; content:"&sgn="; content:"&subid2="; content:"&ts="; http.header_names; content:!"Referer"; content:!"Accept"; reference:md529:T6b0,4}(?:\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}/R"; reference:md5,abd0a49fda67547639eeaced7955a01a; classtype:misc-attack; sid:2034183; rev:1; metadata:created_at 2021_10_13, former_category ATTACK_RESPONSE, update; Source: "suricata.bin"), Found string - y (msg:"ET COINMINER CoinHive In-Browser Miner Detected"; flow:established,from_server; file_data; content:"coinhive.min.js"; nocase; fast_pattern; content:"start"; nocase; distance:0; content:"script"; content:"var"; distance:0; pcre:"/^\s*(?P[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^$]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(?:\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?$\s*\x3b\s+(?P=var)\s*\.\s*start/Ri"; classtype:coin-mining; sid:2024721; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2017_09_18, deployment Perimeter, former_category COINMINER, performance_impact Moderate, signature_severity Minor, updated_at 2018_05_08;)alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET COINMINER Random Hash Pascalcoin Miner Checkin"; flow:established,to_server; content:"{|22|params|22|:[|22|rhminer/"; depth:20; classtype:coin-mining; sid:2026750; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_; Source: "suricata.bin"), Found string - /find-new-web-bot-jembot.html?m=1; classtype:web-application-activity; sid:2014615; rev:3; metadata:created_at 2012_04_18, updated_at 2012_04_18;)# alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS FedEX Spam Inbound"; flow:established,to_server; content:"name=|22|FEDEX"; nocase; content:".zip|22|"; within:47; nocase; pcre:"/name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{02a:T482,updated_at 2014_11_20;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Magnitude Flash Payload"; flow:established,to_server; urilen:34; content:"/?"; http_uri; depth:2; fast_pattern; content:!"User-Agent"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; pcre:"/^\/\?[a-f0-9]{32}$/U"; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(?:\x3a\d{1,5})?\r\n/H"; classtype:exploit-kit; sid:2019800; rev:2; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SoakSoak Malware GET request"; flow:established,to_server; content:"GET"; http_method; content:"/xteas/code"; http_uri; fast_pattern:only; pcre:"/^Host\x3a[^\r\n]+soaksoak\.ru/Hmi"; pcre:"/^\/xteas\/code$/U"; reference:url,blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpress-websites.html; classtype:trojan-activity; sid:2019939; rev:3; metadata:; Source: "suricata.bin"), Found string - ntent:"UPS"; nocase; within:11; content:".zip|22|"; within:74; nocase; pcre:"/name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{02b:T617,300}eval\((?P=obj1)\./Rs"; content:" = |7b|__proto__|3a|"; fast_pattern; content:"eval|28|"; reference:cve,2019-0567; classtype:attempted-admin; sid:2033783; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_08_25, cve CVE_2019_0567, deployment Perimeter, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_08_25;)alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Prestashop Orderfiles Module Arbitrary File Upload"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"/index.php"; startswith; nocase; content:"module=orderfiles"; nocase; content:"controller=filesmanager"; nocase; fast_pattern; http.request_body; content:"addfile"; nocase; content:"file|5b|"; nocase; classtype:attempted-admin; sid:2033826; rev:1; metadata:attack_target Server, created_at 2021_08_27, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_08_27;)alert http any a; Source: "suricata.bin"), Found string - metadata:affected_product Web_Server_Applications, attack_target Networking_Equipment, created_at 2021_09_21, cve CVE_2020_3580, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2021_09_21;)alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Edge Chakra - InlineArrayPush Type Confusion Inbound M2 (CVE-2018-8617)"; flow:established,from_server; file_data; content:"function"; pcre:"/^\s*(?P[\w\-]{1,20})\((?P[\w\-]{1,20})\s*2c:T56d,3}$/"; threshold:type both,track by_src, count 30, seconds 60; reference:url,isc.sans.edu/diary/rss/29304; reference:md5,512d5c2ba6b14f732061fc2f28a72f72; classtype:misc-attack; sid:2042956; rev:1; metadata:attack_target Linux_Unix, created_at 2022_12_16, deployment Perimeter, former_category EXPLOIT, malware_family Mirai, signature_severity Major, updated_at 2022_12_16; target:src_ip;)alert http any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)"; flow:established,to_server; http.method; content:"POST"; http.u; Source: "suricata.bin"), Found string - -talks-at-nato-summit; reference:cve,2023-36884; classtype:attempted-admin; sid:2046810; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_07_12, cve CVE_2023_36884, deployment Perimeter, former_category EXPLOIT, performance_impact Low, confidence High, signature_severity Major, tag Storm_0978, updated_at 2023_07_12; target:src_ip;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2"; flow:established,to_server; flowbits:isset,ET.CVE-2023-36884.Storm-0978; http.method; content:"GET"; http.uri; content:"/MSHTML_"; startswith; content:".asp?d="; fast_pattern; pcre:"/^\d{12d:T432,3}_[a-f0-9]{5}_/R"; reference:url,blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit; reference:cve,2023-36884; classtype:attempted-admin; sid:2046811; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_ta; Source: "suricata.bin"), Found string - 030; rev:2; metadata:created_at 2013_06_19, updated_at 2013_06_19;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT NailedPack EK Landing June 18 2013"; flow:established,to_client; file_data; content:"report_and_get_exploits(_0x"; reference:url,www.basemont.com/june_2013_exploit_kit_2; classtype:exploit-kit; sid:2017034; rev:2; metadata:created_at 2013_06_19, updated_at 2013_06_19;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Rawin Exploit Kit Landing URI Struct"; flow:established,to_server; content:".php?"; http_uri; content:"v=1."; http_uri; fast_pattern; content:"."; http_uri; distance:1; within:1; pcre:"/\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.(?:(?:4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{12e:T427,Found string - T Evil Redirector Leading To EK Jul 30 M1"; flow:established,to_server; content:".js?chbstr=0."; http_uri; pcre:"/\.js\?chbstr=0\.\d+$/U"; classtype:exploit-kit; sid:2022995; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_07_30, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_30;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Aug1 2016"; flow:established,from_server; file_data; content:"|76 61 72 20 68 65 61 64 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 62 6f 64 79 27 29 5b 30 5d 3b 20 76 61 72 20 73 63 72 69 70 74 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 73 63 72 69 70 74 2e 73 72 63 3d 20 22 2f 2f|"; pcre:"/^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*scrip; Source: "suricata.bin")2f:T516,Found string - dia Related Media Manager Spyware Checkin"; flow:established,to_server; http.user_agent; content:"MM|20|"; startswith; pcre:"/^MM \d\.\d+$/"; classtype:pup-activity; sid:2013388; rev:6; metadata:created_at 2011_08_10, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Suspicious User-Agent (go-diva)"; flow:to_server,established; http.user_agent; content:"go-diva"; reference:url,pcthreat.com/parasitebyid-8835en.html; classtype:pup-activity; sid:2013452; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_08_24, deployment Perimeter, former_category ADWARE_PUP, signature_severity Major, tag User_Agent, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP UBar Trojan/Adware Checkin 1"; flow:established,to_server; http.uri; content:"?gname="; content:"&pid="; content:"&m="; http.header; content:"|20|from|3a 20|http|3a|//www.bsalsa.com/ EmbeddedWB|20|"; reference:md5,81a119f7f476; Source: "suricata.bin"), Found string - ce="; content:"&event="; content:"&implementation_id="; content:"user_id="; content:"&useragent="; content:"&sgn="; content:"&subid2="; content:"&ts="; http.header_names; content:!"Referer"; content:!"Accept"; reference:md530:T6b0,4}(?:\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}/R"; reference:md5,abd0a49fda67547639eeaced7955a01a; classtype:misc-attack; sid:2034183; rev:1; metadata:created_at 2021_10_13, former_category ATTACK_RESPONSE, update; Source: "suricata.bin"), Found string - y (msg:"ET COINMINER CoinHive In-Browser Miner Detected"; flow:established,from_server; file_data; content:"coinhive.min.js"; nocase; fast_pattern; content:"start"; nocase; distance:0; content:"script"; content:"var"; distance:0; pcre:"/^\s*(?P[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^$]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(?:\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?$\s*\x3b\s+(?P=var)\s*\.\s*start/Ri"; classtype:coin-mining; sid:2024721; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2017_09_18, deployment Perimeter, former_category COINMINER, performance_impact Moderate, signature_severity Minor, updated_at 2018_05_08;)alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET COINMINER Random Hash Pascalcoin Miner Checkin"; flow:established,to_server; content:"{|22|params|22|:[|22|rhminer/"; depth:20; classtype:coin-mining; sid:2026750; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_; Source: "suricata.bin"), Found string - /find-new-web-bot-jembot.html?m=1; classtype:web-application-activity; sid:2014615; rev:3; metadata:created_at 2012_04_18, updated_at 2012_04_18;)# alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS FedEX Spam Inbound"; flow:established,to_server; content:"name=|22|FEDEX"; nocase; content:".zip|22|"; within:47; nocase; pcre:"/name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{031:T482,updated_at 2014_11_20;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Magnitude Flash Payload"; flow:established,to_server; urilen:34; content:"/?"; http_uri; depth:2; fast_pattern; content:!"User-Agent"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; pcre:"/^\/\?[a-f0-9]{32}$/U"; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(?:\x3a\d{1,5})?\r\n/H"; classtype:exploit-kit; sid:2019800; rev:2; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SoakSoak Malware GET request"; flow:established,to_server; content:"GET"; http_method; content:"/xteas/code"; http_uri; fast_pattern:only; pcre:"/^Host\x3a[^\r\n]+soaksoak\.ru/Hmi"; pcre:"/^\/xteas\/code$/U"; reference:url,blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpress-websites.html; classtype:trojan-activity; sid:2019939; rev:3; metadata:; Source: "suricata.bin"), Found string - ntent:"UPS"; nocase; within:11; content:".zip|22|"; within:74; nocase; pcre:"/name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{032:T617,300}eval\((?P=obj1)\./Rs"; content:" = |7b|__proto__|3a|"; fast_pattern; content:"eval|28|"; reference:cve,2019-0567; classtype:attempted-admin; sid:2033783; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_08_25, cve CVE_2019_0567, deployment Perimeter, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_08_25;)alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Prestashop Orderfiles Module Arbitrary File Upload"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"/index.php"; startswith; nocase; content:"module=orderfiles"; nocase; content:"controller=filesmanager"; nocase; fast_pattern; http.request_body; content:"addfile"; nocase; content:"file|5b|"; nocase; classtype:attempted-admin; sid:2033826; rev:1; metadata:attack_target Server, created_at 2021_08_27, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_08_27;)alert http any a; Source: "suricata.bin"), Found string - metadata:affected_product Web_Server_Applications, attack_target Networking_Equipment, created_at 2021_09_21, cve CVE_2020_3580, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2021_09_21;)alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Edge Chakra - InlineArrayPush Type Confusion Inbound M2 (CVE-2018-8617)"; flow:established,from_server; file_data; content:"function"; pcre:"/^\s*(?P[\w\-]{1,20})\((?P[\w\-]{1,20})\s*33:T56d,3}$/"; threshold:type both,track by_src, count 30, seconds 60; reference:url,isc.sans.edu/diary/rss/29304; reference:md5,512d5c2ba6b14f732061fc2f28a72f72; classtype:misc-attack; sid:2042956; rev:1; metadata:attack_target Linux_Unix, created_at 2022_12_16, deployment Perimeter, former_category EXPLOIT, malware_family Mirai, signature_severity Major, updated_at 2022_12_16; target:src_ip;)alert http any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)"; flow:established,to_server; http.method; content:"POST"; http.u; Source: "suricata.bin"), Found string - -talks-at-nato-summit; reference:cve,2023-36884; classtype:attempted-admin; sid:2046810; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_07_12, cve CVE_2023_36884, deployment Perimeter, former_category EXPLOIT, performance_impact Low, confidence High, signature_severity Major, tag Storm_0978, updated_at 2023_07_12; target:src_ip;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible Storm-0978 CVE-2023-36884 Exploitation Attempt M2"; flow:established,to_server; flowbits:isset,ET.CVE-2023-36884.Storm-0978; http.method; content:"GET"; http.uri; content:"/MSHTML_"; startswith; content:".asp?d="; fast_pattern; pcre:"/^\d{134:T432,3}_[a-f0-9]{5}_/R"; reference:url,blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit; reference:cve,2023-36884; classtype:attempted-admin; sid:2046811; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_ta; Source: "suricata.bin"), Found string - 030; rev:2; metadata:created_at 2013_06_19, updated_at 2013_06_19;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT NailedPack EK Landing June 18 2013"; flow:established,to_client; file_data; content:"report_and_get_exploits(_0x"; reference:url,www.basemont.com/june_2013_exploit_kit_2; classtype:exploit-kit; sid:2017034; rev:2; metadata:created_at 2013_06_19, updated_at 2013_06_19;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Rawin Exploit Kit Landing URI Struct"; flow:established,to_server; content:".php?"; http_uri; content:"v=1."; http_uri; fast_pattern; content:"."; http_uri; distance:1; within:1; pcre:"/\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.(?:(?:4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{135:T427,Found string - T Evil Redirector Leading To EK Jul 30 M1"; flow:established,to_server; content:".js?chbstr=0."; http_uri; pcre:"/\.js\?chbstr=0\.\d+$/U"; classtype:exploit-kit; sid:2022995; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_07_30, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_30;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Aug1 2016"; flow:established,from_server; file_data; content:"|76 61 72 20 68 65 61 64 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 62 6f 64 79 27 29 5b 30 5d 3b 20 76 61 72 20 73 63 72 69 70 74 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 73 63 72 69 70 74 2e 73 72 63 3d 20 22 2f 2f|"; pcre:"/^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*scrip; Source: "suricata.bin")36:T4ec,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007884) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5ab7f87f0000000000000000000051ed5ab8f87f0000000000007201000000000000000000007dd44fe066c800002a00000000000000d0af44d9720100008fec5ab8f87f0000e0ac5ab7f87f0000e0ac5ab7f87f0000000000000000000000000000f87f0000ffffff7ffd59000000000000000000000000000000000000d8ce4eb7f87f00002a0000000000000069c307b7f87f00003100000000000000d402000000000000d8020000000000001100011000000000e0cd3e486100000003a3cfb6f87f0000e0cd3e486100000000000000000000002b00000000000000000000000000000020b00db7f87f0000b43f0cb7f87f0000e0ce4eb7 (UID: 00000000-00007884)37:T751,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050fa3e4861000000000000000000000060b242d972010000d8f1c3b5f87f000010fa3e48610000000000000000000000011c42d9720100001f000000000000000f00100000000000b06343d97201000000000100 (UID: 00000000-00007884) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000cf33e48610000000000000000000000c0f63e486100000018b444d97201000020ed3e486100000000000000000000004ef7bab4f87f00000cf33e48610000000000000000000000000000000000000099ddc3b5f87f00000000000000000000b0ec3e4861000000c0ec3e4861000000010000006100000000000000 (UID: 00000000-00007884) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bbbb4f87f00000000b9adf87f0000000000000000000000000000000000000806baadf87f00000001000000000000f098ceb6f87f00000001000000000000000100000000000000000000000000000006baadf87f000001000000000000000f18b9adf87f000000000000000000000006baadf87f000000000000 (UID: 00000000-00007884) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31b5adf87f0000708bb7adf87f00000200000000000000708bb7adf87f000000000000000000000300000000000000b131b5adf87f0000a815b8adf87f000090d371d972010000a0d371d972010000888bb7adf87f00000100000000000000239fd0b6f87f00000000000000000000888bb7adf87f000006000000 (UID: 00000000-00007884) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000000000000000000000000000000000000000000e09971d972010000a0e63e486100000008e73e4861000000d0e73e4861000000b0e73e486100000000000000000000000000000000000000000000000000000000000000000000000000000000000000402006e372010000000000000000000000000000 (UID: 00000000-00007884)38:T881,Observed string: "-> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"host="; content:"port="; content:"request=|22|474554"; content:"78705f636d647368656c6c"; fast_pattern; reference:url,blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation; classtype:command-and-control; sid:2034863; rev:1; metadata:created_at 2022_01_10, former_category ATTACK_RESPONSE, updated_at 2022_01_10;)alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"host="; content:"port="; content:"request=|22|GET"; content:"whoami"; fast_pattern; reference:url,blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation; classtype:attempted-recon; sid:2034864; rev:1; metadata:created_at 2022_01_10, former_category ATTACK_RESPONSE, updated_at 202" (Indicator: ""whoami") in Source: suricata.bin Observed string: "signature_severity Informational, updated_at 2023_03_15;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING HTA Download with PowerShell User-Agent"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".hta"; endswith; http.user_agent; content:"WindowsPowerShell/"; fast_pattern; classtype:misc-activity; sid:2044624; rev:1; metadata:created_at 2023_03_15, updated_at 2023_03_15;)alert tcp-pkt $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET HUNTING Whoami Command Inbound On High Port"; flow:established,to_client; content:"whoami"; depth:8; fast_pattern; threshold:type limit, seconds 300, count 1, track by_src; reference:md5,e0a0e407d425a31b13563bfd09132754; classtype:misc-activity; sid:2044770; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2023_03_27, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2023_03_27;)alert tcp-pkt $HOME_NET any -> $EXTERN" (Indicator: ""whoami") in Source: suricata.bin39:T440,Observed string: "-> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"host="; content:"port="; content:"request=|22|474554"; content:"78705f636d647368656c6c"; fast_pattern; reference:url,blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation; classtype:command-and-control; sid:2034863; rev:1; metadata:created_at 2022_01_10, former_category ATTACK_RESPONSE, updated_at 2022_01_10;)alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"host="; content:"port="; content:"request=|22|GET"; content:"whoami"; fast_pattern; reference:url,blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation; classtype:attempted-recon; sid:2034864; rev:1; metadata:created_at 2022_01_10, former_category ATTACK_RESPONSE, updated_at 202" (Indicator: ""whoami") in Source: suricata.bin3a:T43f,Observed string: "signature_severity Informational, updated_at 2023_03_15;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING HTA Download with PowerShell User-Agent"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".hta"; endswith; http.user_agent; content:"WindowsPowerShell/"; fast_pattern; classtype:misc-activity; sid:2044624; rev:1; metadata:created_at 2023_03_15, updated_at 2023_03_15;)alert tcp-pkt $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET HUNTING Whoami Command Inbound On High Port"; flow:established,to_client; content:"whoami"; depth:8; fast_pattern; threshold:type limit, seconds 300, count 1, track by_src; reference:md5,e0a0e407d425a31b13563bfd09132754; classtype:misc-activity; sid:2044770; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2023_03_27, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2023_03_27;)alert tcp-pkt $HOME_NET any -> $EXTERN" (Indicator: ""whoami") in Source: suricata.bin3b:T440,Observed string: "-> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"host="; content:"port="; content:"request=|22|474554"; content:"78705f636d647368656c6c"; fast_pattern; reference:url,blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation; classtype:command-and-control; sid:2034863; rev:1; metadata:created_at 2022_01_10, former_category ATTACK_RESPONSE, updated_at 2022_01_10;)alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"host="; content:"port="; content:"request=|22|GET"; content:"whoami"; fast_pattern; reference:url,blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation; classtype:attempted-recon; sid:2034864; rev:1; metadata:created_at 2022_01_10, former_category ATTACK_RESPONSE, updated_at 202" (Indicator: ""whoami") in Source: suricata.bin3c:T43f,Observed string: "signature_severity Informational, updated_at 2023_03_15;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING HTA Download with PowerShell User-Agent"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".hta"; endswith; http.user_agent; content:"WindowsPowerShell/"; fast_pattern; classtype:misc-activity; sid:2044624; rev:1; metadata:created_at 2023_03_15, updated_at 2023_03_15;)alert tcp-pkt $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET HUNTING Whoami Command Inbound On High Port"; flow:established,to_client; content:"whoami"; depth:8; fast_pattern; threshold:type limit, seconds 300, count 1, track by_src; reference:md5,e0a0e407d425a31b13563bfd09132754; classtype:misc-activity; sid:2044770; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2023_03_27, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2023_03_27;)alert tcp-pkt $HOME_NET any -> $EXTERN" (Indicator: ""whoami") in Source: suricata.bin3d:T1692,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007884) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007884)3e:T5bcb,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp, 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007884.00000000.74007.A7922000.00000002.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00007884.00000000.74007.D9420000.00000004.mdmp, 00000000-00007884.00000000.74007.DCFE0000.00000002.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00007884.00000000.74007.D9420000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtrA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtrA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp")3f:Tdba,"threats.net/bin/view/Main/2000371; classtype:pup-activity; sid:2000371; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)# alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET ADWARE_PUP User-Agent (iexplore)"; flow:established,to_server; content:"User-Agent|3a| iexplore|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2000466; classtype:pup-activity; sid:2000466; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP IE homepage hijacking"; flow: from_server,established; content:"wsh.RegWrite"; nocase; content:"HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main\\\\Start Page"; nocase; reference:url,www.geek.com/news/geeknews/2004Jun/gee20040610025522.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000514; classtype:pup-activity; sid:2000514; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 201" in Source: suricata.bin "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007884.00000000.74007.D9420000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007884.00000000.74007.D9420000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007884.00000000.74007.D9420000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007884.00000000.74007.D9420000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007884.00000000.74007.DCAF0000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00007884.00000000.74007.DCFD5000.00000002.mdmp40:T418,"threats.net/bin/view/Main/2000371; classtype:pup-activity; sid:2000371; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)# alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET ADWARE_PUP User-Agent (iexplore)"; flow:established,to_server; content:"User-Agent|3a| iexplore|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2000466; classtype:pup-activity; sid:2000466; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP IE homepage hijacking"; flow: from_server,established; content:"wsh.RegWrite"; nocase; content:"HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main\\\\Start Page"; nocase; reference:url,www.geek.com/news/geeknews/2004Jun/gee20040610025522.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000514; classtype:pup-activity; sid:2000514; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 201" in Source: suricata.bin41:T418,"threats.net/bin/view/Main/2000371; classtype:pup-activity; sid:2000371; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)# alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET ADWARE_PUP User-Agent (iexplore)"; flow:established,to_server; content:"User-Agent|3a| iexplore|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2000466; classtype:pup-activity; sid:2000466; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)# alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP IE homepage hijacking"; flow: from_server,established; content:"wsh.RegWrite"; nocase; content:"HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main\\\\Start Page"; nocase; reference:url,www.geek.com/news/geeknews/2004Jun/gee20040610025522.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000514; classtype:pup-activity; sid:2000514; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 201" in Source: suricata.bin42:Taf6,Found string "twitter.com/MichalKoczwara/status/1652986620658761729" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/JAMESWT_MHT/status/1588046613624356864" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/StopMalvertisin/status/1659156583715311617" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/StopMalvertisin/status/1649371042090205184" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/pr0xylife/status/1561737165255725057" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/suyog41/status/1636329384947720196" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/fmc_nan/status/1634096201577660416" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/James_inthe_box/status/1298742352069054464" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/James_inthe_box/status/1433481199939297308" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/ShadowChasing1/status/1403150596849295362" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/malPileDiver/status/1648407500457222146" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/AzakaSekai_/status/1628446258649235456" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/James_inthe_box/status/1319298609255383040" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/JAMESWT_MHT/status/1433706754555138066" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/craiu/status/1309449368559378432" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/ShadowChasing1/status/1379048935969316871" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/James_inthe_box/status/1248010996502769664" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/c3rb3ru5d3d53c/status/1370740134937772037" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/h2jazi/status/1555205042331947011" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/James_inthe_box/status/1290773214520434690" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/h2jazi/status/1602302208325947394" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/James_inthe_box/status/1410260077861249028" (Indicator: "twitter"; File: "suricata.bin") Found string "www.facebook.com/sitetour/chat.php" (Indicator: "facebook.com"; File: "suricata.bin") Found string "twitter.com/StopMalvertisin/status/1624033048940642310" (Indicator: "twitter"; File: "suricata.bin") Found string "twitter.com/InQuest/status/1582114710740008960" (Indicator: "twitter"; File: "suricata.bin")43:T853,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base b4b50000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base b4b50000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base b4b50000 "WScript.exe" loaded module "KERNEL32" at base b5c30000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base add00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base b2f30000 "WScript.exe" loaded module "RPCRT4.DLL" at base b65e0000 "WScript.exe" loaded module "KERNEL32.DLL" at base b5c30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base adc30000 "WScript.exe" loaded module "AMSI.DLL" at base adc10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base abea0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base a7910000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSXVIE3L.DLL" at base adbc0000 "WScript.exe" loaded module "WLDP.DLL" at base b3910000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base b6f10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base b4e70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base b3cf0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base adbb0000 "WScript.exe" loaded module "OLE32.DLL" at base b6700000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base b4960000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base adb90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base adb50000 "WScript.exe" loaded module "OLEAUT32.DLL" at base b6380000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base b6450000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base b6450000 "WScript.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base b6850000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base b6b60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base b670000044:T51d,Observed system executable string:"NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Possible Remote System32 DLL Hijack Command Inbound via HTTP (T1038, T1105)"; flow:established,from_server; content:"200"; http_stat_code; file_data; content:"copy|20|"; content:".dll"; distance:0; content:"|5c|Windows|5c|System32|5c|"; distance:0; fast_pattern; content:".dll"; distance:0; content:"copy|20|"; pcre:"/^(?P[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1 3}|([a-z0-9\-]{1,30}\.){1 8}[a-z]{1 8})\\\w{1 10}\$\\Windows\\System32\\(?P=dll_name)\.dll/Ri"; reference:url,posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992; classtype:attempted-user; sid:2027268; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_04_23, deployment Internal, former_category ATTACK_RESPONSE, performance_impact Low, signature_severity Major, tag T1038, tag T1105, updated_at 2019_04_23;)alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfilt" [Source: suricata.bin], Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007884-00000C25-24438301], Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007884-00000C25-24828083]45:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")46:Tf58,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")47:T85c,"n micorsofts.com"; content:"|0a|micorsofts|03|com|00|"; nocase; fast_pattern; threshold: type limit track by_src count 1 seconds 300; reference:url labs.alienvault.com; classtype:targeted-activity; sid:2016570; rev:3; metadata:created_at 2013_03_14 former_category DNS updated_at 2019_10_08;)alert dns $HOME_NET any -> any any (msg:"ET DNS DNS Query for Illegal Drug Sales Site (SilkRoad)"; dns.query; content:"ianxz6zefk72ulzz.onion"; depth:22; classtype:policy-violation; sid:2013016; rev:5; metadata:created_at 2011_06_13, updated_at 2020_09_01;)alert dns $HOME_NET any -> any any (msg:"ET DNS Query for .su TLD (Soviet Union) Often Malware Related"; dns.query; content:".su"; nocase; endswith; reference:url,www.abuse.ch/?p=3581; classtype:bad-unknown; sid:2014169; rev:4; metadata:created_at 2012_01_31, updated_at 2020_09_14;)alert dns $HOME_NET any -> any any (msg:"ET DNS Query to a *.top domain - Likely Hostile"; threshold:type limit, track by_src, count 1, seconds 30; dns.query; content:".top"; nocase; e" (Indicator: ".onion") in Source: suricata.bin "ature_severity Informational, updated_at 2022_04_05;)alert dns $HOME_NET any -> any any (msg:"ET INFO Proxy Domain in DNS Lookup (proxynet .io)"; dns.query; dotprefix; content:".proxynet.io"; nocase; endswith; classtype:misc-activity; sid:2035757; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_05, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_04_05;)alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO BrowseTor .onion Proxy Service SSL Cert"; flow:established,to_client; tls.cert_subject; content:"CN=*.browsetor.com"; fast_pattern; classtype:bad-unknown; sid:2018396; rev:5; metadata:attack_target Client_Endpoint, created_at 2014_04_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_04_06;)alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed URL Shortening Service Domain (s59 .site) in TLS SN" (Indicator: ".onion") in Source: suricata.bin48:T42d,"ature_severity Informational, updated_at 2022_04_05;)alert dns $HOME_NET any -> any any (msg:"ET INFO Proxy Domain in DNS Lookup (proxynet .io)"; dns.query; dotprefix; content:".proxynet.io"; nocase; endswith; classtype:misc-activity; sid:2035757; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_05, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_04_05;)alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO BrowseTor .onion Proxy Service SSL Cert"; flow:established,to_client; tls.cert_subject; content:"CN=*.browsetor.com"; fast_pattern; classtype:bad-unknown; sid:2018396; rev:5; metadata:attack_target Client_Endpoint, created_at 2014_04_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_04_06;)alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed URL Shortening Service Domain (s59 .site) in TLS SN" (Indicator: ".onion") in Source: suricata.bin49:T42d,"ature_severity Informational, updated_at 2022_04_05;)alert dns $HOME_NET any -> any any (msg:"ET INFO Proxy Domain in DNS Lookup (proxynet .io)"; dns.query; dotprefix; content:".proxynet.io"; nocase; endswith; classtype:misc-activity; sid:2035757; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_05, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_04_05;)alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO BrowseTor .onion Proxy Service SSL Cert"; flow:established,to_client; tls.cert_subject; content:"CN=*.browsetor.com"; fast_pattern; classtype:bad-unknown; sid:2018396; rev:5; metadata:attack_target Client_Endpoint, created_at 2014_04_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_04_06;)alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed URL Shortening Service Domain (s59 .site) in TLS SN" (Indicator: ".onion") in Source: suricata.bin4a:T3302,Observed string: "709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022716; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?mid="; fast_pattern; pcre:"/\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$/i"; http.user_agent; content:"curl/"; startswith; http.header_names; content:!"Referer|0d 0a|"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022717; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 2"; flow" (Indicator: ""curl") in Source: suricata.bin Observed string: ":established,to_server; http.method; content:"POST"; http.uri; content:!"."; http.user_agent; content:"curl/"; startswith; http.request_body; content:"vs_mid="; depth:7; fast_pattern; content:"&br_mid="; content:"&event_type="; content:"diss URL"; nocase; http.header_names; content:!"Referer|0d 0a|"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022718; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit Web Injects"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/mu?id="; fast_pattern; content:"&d="; content:"&cl="; pcre:"/\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$/i"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,8" (Indicator: ""curl") in Source: suricata.bin Observed string: ":"&id="; content:"&cu="; content:"&ci="; content:"&cv="; content:"&iv="; content:"&pchid="; content:"&ug="; http.header_names; content:!"Referer|0d 0a|"; reference:url,www.cybereason.com/blog/targetingedge-mac-os-x-pirrit-malware-adware-still-active; classtype:pup-activity; sid:2033028; rev:1; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2021_05_25, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Minor, updated_at 2021_05_25;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 4"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/exec.tgz"; endswith; fast_pattern; http.user_agent; content:"curl/"; startswith; http.header_names; content:!"Referer|0d 0a|"; reference:url,malpedia.caad.fkie.fraunhofer.de/details/osx.pirrit; classtype:pup-activity; sid:2033029; rev:1; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2021_05_25, deployment P" (Indicator: ""curl") in Source: suricata.bin Observed string: "d:2034903; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_01_12, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_01_12, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Kuwo Music Installer Log"; flow:established,to_server; http.request_line; content:"POST|20|/music.yl|20|"; startswith; fast_pattern; http.user_agent; content:"curl/"; startswith; http.request_body; pcre:"/(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)/"; reference:md5,9387e26f309874d834d4bb699808654d; classtype:pup-activity; sid:2034907; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_01_12, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_01_13, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/RemoteUti" (Indicator: ""curl") in Source: suricata.bin Observed string: "ossible 2012-1533 altjvm RCE via JNLP command injection"; flow:established from_server; file_data; content:" $HTTP_SERVERS any (msg:"ET EXPLOIT SolusVM WHMCS CURL Multi-part Boundary Issue"; flow:established,to_server; content:"POST"; http_method; content:"/rootpassword.php?"; http_uri; fast_pattern; content:"name=action"; content:"name=action"; distance:0; content:"name=action"; distance:0; reference:url,localhost.re/p/solusvm-whmcs-module-316-vulnerability; classtype:trojan-activity; sid:2017063; rev:4; metadata:created_at 2013_06_25, former_category EXPLOIT, updated_at 2019_10_08;)alert http $HOME_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT SolusVM 1.13.03 Access to solusvmc-node setuid bin"; flow:established,to" (Indicator: " curl ") in Source: suricata.bin Observed string: "file.data; content:"|7f 45 4c 46|"; startswith; fast_pattern; isdataat:3000,relative; classtype:bad-unknown; sid:2032973; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2021_05_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_05_18;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Office Doc Retrieving Shortened URL (bit .do)"; flow:established,to_server; http.method; content:"GET"; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.host; content:"bit.do"; bsize:6; fast_pattern; reference:md5,04a303e67b4a2f9f7bb532779aef2c72; classtype:bad-unknown; sid:2033133; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING URL Shortening Service Used by Curl (ic9 .in)"; flow:established,to_server; http.user_" (Indicator: " curl ") in Source: suricata.bin Observed string: "agent; content:"curl/"; startswith; http.host; content:"ic9.in"; bsize:6; fast_pattern; classtype:bad-unknown; sid:2033134; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET HUNTING Possible REvil 0day Exploitation Activity Inbound"; flow:established,to_server; content:"|0a|procCreate|28 22|Archive"; content:"procStep|28|"; distance:0; within:50; content:"+++SQLCMD|3a 22|+"; distance:0; within:100; content:"|22|DELETE|20|FROM"; reference:url,blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/; classtype:bad-unknown; sid:2033236; rev:1; metadata:created_at 2021_07_05, former_category HUNTING, updated_at 2021_07_05;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING jpg download from fileupload .site"; flow:established,to_server; http.method; con" (Indicator: ""curl") in Source: suricata.bin Observed string: "11_18, former_sid 2850489;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING curl User-Agent to Dotted Quad"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; nocase; fast_pattern; http.host; pcre:"/^\d{1 3}\.\d{1 3}\.\d{1 3}\.\d{1 3}$/"; classtype:bad-unknown; sid:2034567; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_12_01, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_12_01;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Terse Request for .txt - Likely Hostile"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".txt"; endswith; bsize:6; fast_pattern; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2034581; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_12_03, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_12_03;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Ba" (Indicator: ""curl") in Source: suricata.bin Observed string: "11_18, former_sid 2850489;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING curl User-Agent to Dotted Quad"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; nocase; fast_pattern; http.host; pcre:"/^\d{1 3}\.\d{1 3}\.\d{1 3}\.\d{1 3}$/"; classtype:bad-unknown; sid:2034567; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_12_01, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_12_01;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Terse Request for .txt - Likely Hostile"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".txt"; endswith; bsize:6; fast_pattern; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2034581; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_12_03, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_12_03;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Ba" (Indicator: " curl ") in Source: suricata.bin, Observed string: "ast_pattern; reference:md5 767370995ad5bdbcdaee2e3123cfe47c; classtype:bad-unknown; sid:2035768; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit attack_target Client_Endpoint created_at 2022_04_06 deployment Perimeter former_category HUNTING signature_severity Minor updated_at 2022_04_06;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request To Suspicious Filename via Powershell (payload)"; flow:established,to_server; http.uri; content:"/payload"; startswith; bsize:8; fast_pattern; http.user_agent; content:"Mozilla/"; startswith; content:") WindowsPowerShell/"; distance:0; reference:md5,5ec22f6399ec0c51d120d27ecd26f2be; classtype:bad-unknown; sid:2036268; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_19, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2022_04_19;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Curl User-Agent Obs" (Indicator: " curl ") in Source: suricata.bin, Observed string: "erved to Telegram"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; http.host; content:"api.telegram.org"; fast_pattern; reference:md5,ae6eeaa09f5fa4c937928430c397b1ff; reference:url,www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html; classtype:unknown; sid:2044617; rev:1; metadata:created_at 2023_03_14, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, updated_at 2023_03_14;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible Telegram Proxy Site (sendMessage)"; flow:established,to_server; http.uri; content:"/sendMessage?chat_id="; fast_pattern; http.host; content:!"api.telegram.org"; reference:url,core.telegram.org/bots/api#sendmessage; reference:md5,3402c9373726396598011ef6ec1ea243; classtype:unknown; sid:2044620; rev:1; metadata:created_at 2023_03_14, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, signature_severity Informational, updated_at" (Indicator: ""curl") in Source: suricata.bin Observed string: "ployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2021_05_28;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Unix/Linux Processhider Source Being Downloaded"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/d/processhider.c"; bsize:17; fast_pattern; http.user_agent; content:"curl/"; startswith; http.host; content:"m.windowsupdatesupport.org"; bsize:26; reference:md5,4ff3828a2ecc6314bfc7dc22ca194480; reference:url,twitter.com/JAMESWT_MHT/status/1402239031602302983; classtype:bad-unknown; sid:2033117; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_08, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2021_06_08;)alert dns $HOME_NET any -> any any (msg:"ET INFO Observed DNS Query to DDNS Domain .dns1 .us"; dns.query; content:".dns1.us"; endswith; fast_pattern; reference:url,changeip.com; classtype:bad-unknown; sid:2033119; rev:1; metadata:created_at 202" (Indicator: ""curl") in Source: suricata.bin4b:T43e,Observed string: "709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022716; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?mid="; fast_pattern; pcre:"/\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$/i"; http.user_agent; content:"curl/"; startswith; http.header_names; content:!"Referer|0d 0a|"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022717; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 2"; flow" (Indicator: ""curl") in Source: suricata.bin4c:T43f,Observed string: ":established,to_server; http.method; content:"POST"; http.uri; content:!"."; http.user_agent; content:"curl/"; startswith; http.request_body; content:"vs_mid="; depth:7; fast_pattern; content:"&br_mid="; content:"&event_type="; content:"diss URL"; nocase; http.header_names; content:!"Referer|0d 0a|"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022718; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit Web Injects"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/mu?id="; fast_pattern; content:"&d="; content:"&cl="; pcre:"/\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$/i"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,8" (Indicator: ""curl") in Source: suricata.bin4d:T43f,Observed string: ":"&id="; content:"&cu="; content:"&ci="; content:"&cv="; content:"&iv="; content:"&pchid="; content:"&ug="; http.header_names; content:!"Referer|0d 0a|"; reference:url,www.cybereason.com/blog/targetingedge-mac-os-x-pirrit-malware-adware-still-active; classtype:pup-activity; sid:2033028; rev:1; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2021_05_25, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Minor, updated_at 2021_05_25;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 4"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/exec.tgz"; endswith; fast_pattern; http.user_agent; content:"curl/"; startswith; http.header_names; content:!"Referer|0d 0a|"; reference:url,malpedia.caad.fkie.fraunhofer.de/details/osx.pirrit; classtype:pup-activity; sid:2033029; rev:1; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2021_05_25, deployment P" (Indicator: ""curl") in Source: suricata.bin4e:T43e,Observed string: "d:2034903; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_01_12, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_01_12, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Kuwo Music Installer Log"; flow:established,to_server; http.request_line; content:"POST|20|/music.yl|20|"; startswith; fast_pattern; http.user_agent; content:"curl/"; startswith; http.request_body; pcre:"/(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)/"; reference:md5,9387e26f309874d834d4bb699808654d; classtype:pup-activity; sid:2034907; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_01_12, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_01_13, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/RemoteUti" (Indicator: ""curl") in Source: suricata.bin4f:T43f,Observed string: "file.data; content:"|7f 45 4c 46|"; startswith; fast_pattern; isdataat:3000,relative; classtype:bad-unknown; sid:2032973; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2021_05_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_05_18;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Office Doc Retrieving Shortened URL (bit .do)"; flow:established,to_server; http.method; content:"GET"; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.host; content:"bit.do"; bsize:6; fast_pattern; reference:md5,04a303e67b4a2f9f7bb532779aef2c72; classtype:bad-unknown; sid:2033133; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING URL Shortening Service Used by Curl (ic9 .in)"; flow:established,to_server; http.user_" (Indicator: " curl ") in Source: suricata.bin50:T43e,Observed string: "agent; content:"curl/"; startswith; http.host; content:"ic9.in"; bsize:6; fast_pattern; classtype:bad-unknown; sid:2033134; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET HUNTING Possible REvil 0day Exploitation Activity Inbound"; flow:established,to_server; content:"|0a|procCreate|28 22|Archive"; content:"procStep|28|"; distance:0; within:50; content:"+++SQLCMD|3a 22|+"; distance:0; within:100; content:"|22|DELETE|20|FROM"; reference:url,blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/; classtype:bad-unknown; sid:2033236; rev:1; metadata:created_at 2021_07_05, former_category HUNTING, updated_at 2021_07_05;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING jpg download from fileupload .site"; flow:established,to_server; http.method; con" (Indicator: ""curl") in Source: suricata.bin51:T742,updated_at 2022_04_06;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request To Suspicious Filename via Powershell (payload)"; flow:established,to_server; http.uri; content:"/payload"; startswith; bsize:8; fast_pattern; http.user_agent; content:"Mozilla/"; startswith; content:") WindowsPowerShell/"; distance:0; reference:md5,5ec22f6399ec0c51d120d27ecd26f2be; classtype:bad-unknown; sid:2036268; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_19, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2022_04_19;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Curl User-Agent Obs" (Indicator: " curl ") in Source: suricata.bin, Observed string: "erved to Telegram"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; http.host; content:"api.telegram.org"; fast_pattern; reference:md5,ae6eeaa09f5fa4c937928430c397b1ff; reference:url,www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html; classtype:unknown; sid:2044617; rev:1; metadata:created_at 2023_03_14, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, updated_at 2023_03_14;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible Telegram Proxy Site (sendMessage)"; flow:established,to_server; http.uri; content:"/sendMessage?chat_id="; fast_pattern; http.host; content:!"api.telegram.org"; reference:url,core.telegram.org/bots/api#sendmessage; reference:md5,3402c9373726396598011ef6ec1ea243; classtype:unknown; sid:2044620; rev:1; metadata:created_at 2023_03_14, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, signature_severity Informational, updated_at" (Indicator: ""curl") in Source: suricata.bin52:T43e,Observed string: "ployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2021_05_28;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Unix/Linux Processhider Source Being Downloaded"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/d/processhider.c"; bsize:17; fast_pattern; http.user_agent; content:"curl/"; startswith; http.host; content:"m.windowsupdatesupport.org"; bsize:26; reference:md5,4ff3828a2ecc6314bfc7dc22ca194480; reference:url,twitter.com/JAMESWT_MHT/status/1402239031602302983; classtype:bad-unknown; sid:2033117; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_08, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2021_06_08;)alert dns $HOME_NET any -> any any (msg:"ET INFO Observed DNS Query to DDNS Domain .dns1 .us"; dns.query; content:".dns1.us"; endswith; fast_pattern; reference:url,changeip.com; classtype:bad-unknown; sid:2033119; rev:1; metadata:created_at 202" (Indicator: ""curl") in Source: suricata.bin53:T43e,Observed string: "709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022716; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?mid="; fast_pattern; pcre:"/\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$/i"; http.user_agent; content:"curl/"; startswith; http.header_names; content:!"Referer|0d 0a|"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022717; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 2"; flow" (Indicator: ""curl") in Source: suricata.bin54:T43f,Observed string: ":established,to_server; http.method; content:"POST"; http.uri; content:!"."; http.user_agent; content:"curl/"; startswith; http.request_body; content:"vs_mid="; depth:7; fast_pattern; content:"&br_mid="; content:"&event_type="; content:"diss URL"; nocase; http.header_names; content:!"Referer|0d 0a|"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,85846678ad4dbff608f2e51bb0589a16; classtype:pup-activity; sid:2022718; rev:4; metadata:created_at 2016_04_08, former_category ADWARE_PUP, updated_at 2020_08_31;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit Web Injects"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/mu?id="; fast_pattern; content:"&d="; content:"&cl="; pcre:"/\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$/i"; reference:url,go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf; reference:md5,8" (Indicator: ""curl") in Source: suricata.bin55:T43f,Observed string: ":"&id="; content:"&cu="; content:"&ci="; content:"&cv="; content:"&iv="; content:"&pchid="; content:"&ug="; http.header_names; content:!"Referer|0d 0a|"; reference:url,www.cybereason.com/blog/targetingedge-mac-os-x-pirrit-malware-adware-still-active; classtype:pup-activity; sid:2033028; rev:1; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2021_05_25, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Minor, updated_at 2021_05_25;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OSX/Adware.Pirrit CnC Activity 4"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/exec.tgz"; endswith; fast_pattern; http.user_agent; content:"curl/"; startswith; http.header_names; content:!"Referer|0d 0a|"; reference:url,malpedia.caad.fkie.fraunhofer.de/details/osx.pirrit; classtype:pup-activity; sid:2033029; rev:1; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2021_05_25, deployment P" (Indicator: ""curl") in Source: suricata.bin56:T43e,Observed string: "d:2034903; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_01_12, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_01_12, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Kuwo Music Installer Log"; flow:established,to_server; http.request_line; content:"POST|20|/music.yl|20|"; startswith; fast_pattern; http.user_agent; content:"curl/"; startswith; http.request_body; pcre:"/(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)/"; reference:md5,9387e26f309874d834d4bb699808654d; classtype:pup-activity; sid:2034907; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_01_12, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_01_13, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/RemoteUti" (Indicator: ""curl") in Source: suricata.bin57:T43f,Observed string: "file.data; content:"|7f 45 4c 46|"; startswith; fast_pattern; isdataat:3000,relative; classtype:bad-unknown; sid:2032973; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2021_05_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_05_18;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Office Doc Retrieving Shortened URL (bit .do)"; flow:established,to_server; http.method; content:"GET"; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.host; content:"bit.do"; bsize:6; fast_pattern; reference:md5,04a303e67b4a2f9f7bb532779aef2c72; classtype:bad-unknown; sid:2033133; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING URL Shortening Service Used by Curl (ic9 .in)"; flow:established,to_server; http.user_" (Indicator: " curl ") in Source: suricata.bin58:T43e,Observed string: "agent; content:"curl/"; startswith; http.host; content:"ic9.in"; bsize:6; fast_pattern; classtype:bad-unknown; sid:2033134; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET HUNTING Possible REvil 0day Exploitation Activity Inbound"; flow:established,to_server; content:"|0a|procCreate|28 22|Archive"; content:"procStep|28|"; distance:0; within:50; content:"+++SQLCMD|3a 22|+"; distance:0; within:100; content:"|22|DELETE|20|FROM"; reference:url,blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/; classtype:bad-unknown; sid:2033236; rev:1; metadata:created_at 2021_07_05, former_category HUNTING, updated_at 2021_07_05;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING jpg download from fileupload .site"; flow:established,to_server; http.method; con" (Indicator: ""curl") in Source: suricata.bin59:T742,updated_at 2022_04_06;)# alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request To Suspicious Filename via Powershell (payload)"; flow:established,to_server; http.uri; content:"/payload"; startswith; bsize:8; fast_pattern; http.user_agent; content:"Mozilla/"; startswith; content:") WindowsPowerShell/"; distance:0; reference:md5,5ec22f6399ec0c51d120d27ecd26f2be; classtype:bad-unknown; sid:2036268; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_19, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2022_04_19;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Curl User-Agent Obs" (Indicator: " curl ") in Source: suricata.bin, Observed string: "erved to Telegram"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; http.host; content:"api.telegram.org"; fast_pattern; reference:md5,ae6eeaa09f5fa4c937928430c397b1ff; reference:url,www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html; classtype:unknown; sid:2044617; rev:1; metadata:created_at 2023_03_14, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, updated_at 2023_03_14;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible Telegram Proxy Site (sendMessage)"; flow:established,to_server; http.uri; content:"/sendMessage?chat_id="; fast_pattern; http.host; content:!"api.telegram.org"; reference:url,core.telegram.org/bots/api#sendmessage; reference:md5,3402c9373726396598011ef6ec1ea243; classtype:unknown; sid:2044620; rev:1; metadata:created_at 2023_03_14, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, signature_severity Informational, updated_at" (Indicator: ""curl") in Source: suricata.bin5a:T43e,Observed string: "ployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2021_05_28;)alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Unix/Linux Processhider Source Being Downloaded"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/d/processhider.c"; bsize:17; fast_pattern; http.user_agent; content:"curl/"; startswith; http.host; content:"m.windowsupdatesupport.org"; bsize:26; reference:md5,4ff3828a2ecc6314bfc7dc22ca194480; reference:url,twitter.com/JAMESWT_MHT/status/1402239031602302983; classtype:bad-unknown; sid:2033117; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_08, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2021_06_08;)alert dns $HOME_NET any -> any any (msg:"ET INFO Observed DNS Query to DDNS Domain .dns1 .us"; dns.query; content:".dns1.us"; endswith; fast_pattern; reference:url,changeip.com; classtype:bad-unknown; sid:2033119; rev:1; metadata:created_at 202" (Indicator: ""curl") in Source: suricata.bin5b:Tc15,Found string "docs.google.com" (Indicator: "docs.google.com"; File: "suricata.bin") Found string "firebasestorage.googleapis.com" (Indicator: ".googleapis.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/mcw0/PoC/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/Cisco-Talos/IOCs/main/2023/03/prometei-botnet-improves.txt?ref=cisco-talos-blog" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "api.pcloud.com" (Indicator: "api.pcloud.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/theori-io/pwnjs" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "content.dropboxapi.com" (Indicator: "content.dropboxapi.com"; File: "suricata.bin") Found string "commondatastorage.googleapis.com" (Indicator: ".googleapis.com"; File: "suricata.bin") Found string "oauth2.googleapis.com" (Indicator: ".googleapis.com"; File: "suricata.bin") Found string "raw.githubusercontent.com" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/zeropwn/Linksys-Smart-WiFi-Information-Disclosure/master/nss.py" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "cdn.discordapp.com" (Indicator: "cdn.discordapp.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/MISP/misp-warninglists/main/lists/dynamic-dns/list.json" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/pan-unit42/iocs/master/Gamaredon/2022_02_Gamaredon_UPDATE.txt" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "api.dropboxapi.com" (Indicator: "api.dropboxapi.com"; File: "suricata.bin") Found string "fonts.googleapis.com" (Indicator: ".googleapis.com"; File: "suricata.bin") Found string "autoscaling.googleapis.com" (Indicator: ".googleapis.com"; File: "suricata.bin") Found string "drive.google.com" (Indicator: "drive.google.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/theori-io/pwnjs/master/examples/CVE-2017-11873.js" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "raw.githubusercontent.com/exodusintel/disclosures/master/CVE_2016_1287_PoC" (Indicator: "githubusercontent.com"; File: "suricata.bin") Found string "drive.google.com/file/d/1WJCXG2SIkVwPEw5dlAE5U__OfDB88zD0/view" (Indicator: "drive.google.com"; File: "suricata.bin") Found string "docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHDnV8VgmVqU5WoeErc" (Indicator: "docs.google.com"; File: "suricata.bin") Found string "docs.google.com/document/u/1/d/e/2PACX-1vR2TWm68bLidO3e2X0wTCqs0609vo5RXB85f6VL_Zm79wtTK59xADKh6MG0G7hSBZi8cPOiQVWAIie0/pub" (Indicator: "docs.google.com"; File: "suricata.bin") file/memory contains long string with (Indicator: "githubusercontent.com"; File: "suricata.bin")5c:T39b2,Observed email domain:"moea.dsmtp.com" [Source: suricata.bin] Observed email domain:"www.eleven.mypop3.org" [Source: suricata.bin] Observed email domain:"ftp.yahoo-inc.dsmtp.com" [Source: suricata.bin] Observed email domain:"et.pdf.in.smtp.attachment" [Source: suricata.bin] Observed email domain:"cpushpop.com" [Source: suricata.bin] Observed email domain:"lists.clean-mx.com/pipermail/viruswatch/20121222/037085.html" [Source: suricata.bin] Observed email domain:"sendsmtp.com" [Source: suricata.bin] Observed email domain:"threatexpert.com/reports.aspx?find=mrb.mail.ru" [Source: suricata.bin] Observed email domain:"toolbar.dsmtp.com" [Source: suricata.bin] Observed email domain:"pop.gmail.com" [Source: suricata.bin] Observed email domain:"lilupophilupop.com/sl.php" [Source: suricata.bin] Observed email domain:"dsmtp.com" [Source: suricata.bin] Observed email domain:"any -> any any (msg:"suricata smb max read queue size exceeded"; flow:to_client; app-layer-event:smb.read_queue_size_exceeded; classtype:protocol-command-decode; sid:2225016; rev:1;)alert smb any any -> any any (msg:"suricata smb max read queue cnt exceeded"; flow:to_client; app-layer-event:smb.read_queue_cnt_exceeded; classtype:protocol-command-decode; sid:2225017; rev:1;)alert smb any any -> any any (msg:"suricata smb too many transactions"; app-layer-event:smb.too_many_transactions; classtype:protocol-command-decode; sid:2225018; rev:1;)alert smtp any any -> any any (msg:"suricata smtp invalid reply"; flow:established,to_client; app-layer-event:smtp.invalid_reply; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220000; rev:1;)alert smtp any any -> any any (msg:"suricata smtp unable to match reply with request"; flow:established,to_client; app-layer-event:smtp.unable_to_match_reply_with_request; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220001; rev:" [Source: suricata.bin] Observed email domain:"1;)alert smtp any any -> any any (msg:"suricata smtp max command line len exceeded"; flow:established; app-layer-event:smtp.max_command_line_len_exceeded; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220002; rev:1;)alert smtp any any -> any any (msg:"suricata smtp max reply line len exceeded"; flow:established,to_client; app-layer-event:smtp.max_reply_line_len_exceeded; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220003; rev:1;)alert smtp any any -> any any (msg:"suricata smtp invalid pipelined sequence"; flow:established,to_server; app-layer-event:smtp.invalid_pipelined_sequence; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220004; rev:1;)alert smtp any any -> any any (msg:"suricata smtp bdat chunk len exceeded"; flow:established; app-layer-event:smtp.bdat_chunk_len_exceeded; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220005; rev:1;)alert smtp any any -> any any (msg:"suricata smtp no server we" [Source: suricata.bin], Observed email domain:"lcome message"; flow:established,to_client; app-layer-event:smtp.no_server_welcome_message; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220006; rev:1;)alert smtp any any -> any any (msg:"suricata smtp tls rejected"; flow:established; app-layer-event:smtp.tls_rejected; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220007; rev:1;)alert smtp any any -> any any (msg:"suricata smtp data command rejected"; flow:established,to_client; app-layer-event:smtp.data_command_rejected; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220008; rev:1;)# alert smtp any any -> any any (msg:"suricata smtp mime parser failed"; flow:established; app-layer-event:smtp.mime_parse_failed; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220009; rev:1;)# alert smtp any any -> any any (msg:"suricata smtp mime malformed message found"; flow:established; app-layer-event:smtp.mime_malformed_msg; flowint:smtp.anomaly.count,+,1; classtype:p" [Source: suricata.bin] Observed email domain:"rotocol-command-decode; sid:2220010; rev:1;)# alert smtp any any -> any any (msg:"suricata smtp mime base64-decoding failed"; flow:established; app-layer-event:smtp.mime_invalid_base64; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220011; rev:1;)# alert smtp any any -> any any (msg:"suricata smtp mime header name len exceeded"; flow:established; app-layer-event:smtp.mime_long_header_name; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220012; rev:1;)# alert smtp any any -> any any (msg:"suricata smtp mime header value len exceeded"; flow:established; app-layer-event:smtp.mime_long_header_value; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220013; rev:1;)# alert smtp any any -> any any (msg:"suricata smtp mime quoted-printable-decoding failed"; flow:established; app-layer-event:smtp.mime_invalid_qp; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220014; rev:1;)# alert smtp any any -> any any (msg:"suric" [Source: suricata.bin], Observed email domain:"ata smtp mime line len exceeded"; flow:established; app-layer-event:smtp.mime_long_line; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220015; rev:1;)# alert smtp any any -> any any (msg:"suricata smtp mime encoded line len exceeded"; flow:established; app-layer-event:smtp.mime_long_enc_line; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220016; rev:1;)alert smtp any any -> any any (msg:"suricata smtp mime boundary length exceeded"; flow:established,to_server; app-layer-event:smtp.mime_long_boundary; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220017; rev:1;)alert smtp any any -> any any (msg:"suricata smtp duplicate fields"; flow:established,to_server; app-layer-event:smtp.duplicate_fields; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220018; rev:1;)alert smtp any any -> any any (msg:"suricata smtp unparsable content"; flow:established,to_server; app-layer-event:smtp.unparsable_content; flowint:smtp" [Source: suricata.bin] Observed email domain:".anomaly.count,+,1; classtype:protocol-command-decode; sid:2220019; rev:1;)alert smtp any any -> any any (msg:"suricata smtp filename truncated"; flow:established,to_server; app-layer-event:smtp.mime_long_filename; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220020; rev:1;)alert smtp any any -> any any (msg:"suricata smtp failed protocol change"; flow:established; app-layer-event:smtp.failed_protocol_change; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220021; rev:1;)alert tcp any any -> any any (msg:"suricata stream 3way handshake with ack in wrong dir"; stream-event:3whs_ack_in_wrong_dir; classtype:protocol-command-decode; sid:2210000; rev:2;)alert tcp any any -> any any (msg:"suricata stream 3way handshake async wrong sequence"; stream-event:3whs_async_wrong_seq; classtype:protocol-command-decode; sid:2210001; rev:2;)alert tcp any any -> any any (msg:"suricata stream 3way handshake right seq wrong ack evasion"; stream-event:3whs_right_seq_wrong_ac" [Source: suricata.bin] Observed email domain:"gnature_severity major, tag activex, updated_at 2019_09_27;)alert http $external_net any -> $home_net any (msg:"et activex easymail object smtp component buffer overflow function call attempt"; flow:from_server,established; content:"activexobject"; nocase; content:"easymail.smtp.6"; distance:0; nocase; pcre:"/(addattachment|submittoexpress)/i"; reference:url,secunia.com/advisories/24199/; reference:url,www.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/oracle_dc_submittoexpress.rb; reference:url,doc.emergingthreats.net/2010657; classtype:web-application-attack; sid:2010657; rev:6; metadata:created_at 2010_07_30, former_category activex, confidence high, updated_at 2019_09_27;)alert http $external_net any -> $home_net any (msg:"et activex aoa audio extractor activex control buffer overflow attempt"; flow:to_client,established; content:"