Search

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1001852* - Identified Attempt To Brute Force Windows Login Credentials (ATT&CK T1110) DCERPC Services - Client 1010594* - Google Chro...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Azure Open Management Infrastructure Tool 1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647) DCERPC Servi...

* indicates a new version of an existing rule Deep Packet Inspection Rules: OpenSSL Client 1011370 - OpenSSL Client Denial Of Service Vulnerability (CVE-2022-0778) Web Application Common 1011364 - Dolibarr ERP And CRM Code Inje...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Web Application Common 1011468* - Horde Groupware Webmail Insecure Deserialization Vulnerability (CVE-2022-30287) 1011471* - VanDyke VShell Server Comma...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Splunk Enterprise 1011912 - Splunk Enterprise Privilege Escalation Vulnerability (CVE-2023-32707) Web Client Common 1011920 - Google Chrome Type Con...

* indicates a new version of an existing rule Deep Packet Inspection Rules: JetBrains TeamCity 1011815 - JetBrains TeamCity Cross-Site Scripting Vulnerability (CVE-2023-34220) PaperCut 1011855 - PaperCut NG Remote Code Exec...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Web Application Common 1011808 - Progress MOVEit Transfer SQL Injection Vulnerability (CVE-2023-36934) Integrity Monitoring Rules: There are no new or u...

* indicates a new version of an existing rule Deep Packet Inspection Rules: CentOS Web Panel 1011900* - Control Web Panel Command Injection Remote Code Execution Vulnerability (CVE-2023-42120) Jenkins Remoting 1011976* - Jenkin...

* indicates a new version of an existing rule Deep Packet Inspection Rules: HP Intelligent Management Center (IMC) 1012120* - Apache OFBiz Authentication Bypass Vulnerability (CVE-2024-38856) Ivanti Endpoint Manager 1012154*...

* indicates a new version of an existing rule Deep Packet Inspection Rules: HPE Insight Remote Support 1012304* - HPE Insight Remote Support Directory Traversal Vulnerability (CVE-2024-53676) Ivanti Avalanche 1012411 - Ivanti ...

* indicates a new version of an existing rule Deep Packet Inspection Rules: React Server 1012497 - React Server Remote Code Execution Vulnerability (CVE-2025-55182 and CVE-2025-66478) - 1 1012494* - React Server Remote Code ...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Web Server HTTPS 1012555 - Wordpress 'Motors' Theme Elevation of Privilege Vulnerability (CVE-2025-4322) Integrity Monitoring Rules: There are no new or ...

This TorrentLocker variant has the capability to double the amount of decryption after its 5-day deadline. It arrives via spam message purporting as a business email that targeted an Australian company. To get a one-glance comprehensive view of the b...

This ransomware, also known as R980 ransomware, resembles some aspects of RANSOM_MADLOCKER as it drops files other than ransom notes. It also avoids certain file paths. It asks its victims to pay .5 bitcoin as ransom. To get a one-glance comprehensi...

This ransomware is one of the few ransomware families that is capable of spreading on its own. It drops a copy of itself in removable drives, making use of USBs a risky practice. Another notable feature of this ransomware is that it runs on Windows X...

Malware detected as FORMULOAD and HIDDBOOK are formula macro malware where the spreadsheet is set to VeryHidden. These are hidden spreadsheets that cannot be unhidden from Microsoft Excel's user interface, and requires a third party tool should the u...

This ransomware locks the user out of their devices by locking the screen. This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It drops files as ransom no...

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It drops files as ransom note.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It deletes itself after execution.

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It disables Task Manager, Registry Editor, and Folder Options.