Search

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1009490* - Block Administrative Share - 1 (ATT&CK T1021.002) 1007596* - Identified Possible Ransomware File Extension Rename Activity Ov...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1007596* - Identified Possible Ransomware File Extension Rename Activity Over Network Share 1008224* - Microsoft Windows SMB Remote Co...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1007596* - Identified Possible Ransomware File Extension Rename Activity Over Network Share DNS Client 1010771* - DNSmasq DNSSEC Ou...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1009801* - Microsoft Windows NTLM Elevation Of Privilege Vulnerability (CVE-2019-1040) 1001839* - Restrict Attempt To Enumerate Windo...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Asterisk Server IAX2 1003583* - Asterisk IAX2 Resource Exhaustion Denial Of Service 1003778* - Digium Asterisk IAX2 Call Number Denial Of Service DCE...

* indicates a new version of an existing rule Deep Packet Inspection Rules: BIND RNDC 1008099 - ISC BIND rndc Control Channel Denial Of Service Vulnerability (CVE-2016-1285) DCERPC Services 1007596* - Identified Possible Ran...

* indicates a new version of an existing rule Deep Packet Inspection Rules: DCERPC Services 1004542* - Windows Netlogon Service Denial Of Service (CVE-2010-2742) FTP Server Common 1003784* - FTP Server Restrict Executable ...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Database MySQL 1005045* - MySQL Database Server Possible Login Brute Force Attempt Web Application PHP Based 1006432* - WordPress Slider Revolution R...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Azure Open Management Infrastructure Tool 1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647) DCERPC Servi...

The MegaCortex ransomware first appeared in January 2019 with few interesting attributes, including the use of a signed executable as part of the payload. It also appeared to offer security consulting services from the malware author. On May 1, 2019...

This is the Trend Micro detection for possibly malicious executable files that are compressed using Win32 compression tools. This proactive detection also includes appending viruses found in the wild. It is a heuristic detection based on well-establi...

This ransomware comes from a high volume spam campaign that aims to deliver this to as many users possible. This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious s...

This ransomware comes from a high volume spam campaign that aims to deliver this to as many users possible. This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious s...

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Windows NOTES: This detection is for weaponized RTF files. It detects possible exploits for the following vulnerabilities: CVE-2017-11882 CVE-2012-0158 CVE-2015-1641 CVE-2015-1770 CVE-2014-1761 CVE-2017-8570 Step 1 For Trend M...

This is the Trend Micro detection for the tool called Brutus . This hacking tool may be manually installed by a user.

With the .IQY malware being a hot topic in recent months, it comes as no surprise that it has adapted to become another variant that uses the embedding capability of PDFs. It still uses email as th...

Android OS NOTES: Based on analysis of the codes, this Android malware has the following capabilities: Loads a local html page in 1 pixel iframe. The said html tries to open the following malicious URLs: www.{BLOCKED}z.pl/rc/ jL.{...

* indicates a new version of an existing rule Deep Packet Inspection Rules: Mail Server Common 1012173* - Roundcube Webmail Stored Cross-Site Scripting Vulnerability (CVE-2024-42009) NodeBB 1012382 - NodeBB Stored Cross-Site Sc...

FlawedAmmyy is a remote access Trojan (RAT) based on Ammyy Admin , a legitimate remote access tool used to handle remote control and diagnostics on Microsoft Windows machines. FlawedAmmyy RAT has the functionality of the leaked version, including rem...