Search

The Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC) in IIS 3.x and 4.x exposes unsafe methods, which allows remote attacke...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be hosted on a website and run when a user accesses the said website. It does not have any propagat...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It connects to certain websites to send and receive information.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It executes then deletes itself afterward. As of this writing, the said sites are inaccessible. It steals ...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It connects to certain websites to send and receive information. It terminates itself if it detects it is ...

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware/spyware from remote sites. It executes commands from a re...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It injects its dropped file/component to specific processes. It does not have any propagation routine. It ...

Component of Magnitude and Nuclear Exploit Kit exploiting CVE-2016-1019 {(Related thread: RE: [Noteworthy] APSA16-01 (CVE-2016-1019 )} This Trojan executes when a user accesses certain websites where it is hosted. It requires its main component to ...

EXPL_DOCTIFF.GEN is the Trend Micro detection for files that exploit a vulnerability addressed in CVE-2013-3906.

This malware is responsible for dropping the cryptocurrency miner Coinminer.Linux.MALXMR.UWEJI and its rootkit component. It also has multiple ways of propagating itself, spreading via SSH and exploiting CVE-2019-1003001 and CVE-2019-1003000. This Tr...

GAFGYT, also known as BASHLITE, was first discovered in 2014. It is a Linux-based IoT botnet primarily targets any vulnerable IoT devices and uses the device to launch a large-scale distributed denial-of-service attacks. In previous iterations of the...

This Trojan may be dropped by other malware. It takes advantage of certain vulnerabilities.

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1008224 - Microsoft Windows SMB Remote Code Execution Vulnerabilities (CVE-2017-0144 and CVE-2017-0146) 1008225 - Microsoft Windows SM...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1007596* - Identified Possible Ransomware File Extension Rename Activity Over Network Share JetBrains TeamCity 1012199* - JetBrains Team...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Ivanti Avalanche 1012298* - Ivanti Avalanche Authentication Bypass Vulnerability (CVE-2024-13181) Ivanti Endpoint Manager 1012207* - Ivanti Endpoint Man...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Content Management Server Microsoft 1000984* - Microsoft CMS Cross Site Scripting Vulnerability DNS Client 1008053 - ISC BIND DNAME Answer Handling...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1005140* - Print Spooler Service Format String Vulnerability (CVE-2012-1851) 1004696* - SMB Request Parsing Vulnerability (CVE-201...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1008679* - Identified BADRABBIT Ransomware Propagation Over SMB 1008327* - Identified Server Suspicious SMB Session 1010214* - Identifi...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1012187* - Microsoft Windows SMB Denial of Service Vulnerability (CVE-2024-43642) HP Intelligent Management Center (IMC) 1012208* - Apac...