| 56706 VID75303 OnlineNotepad Raw Data Request Detected - Outbound |
|
NDR Active Threat Intelligence |
2 |
| 56707 VID75303 OnlineNotepad Direct Download Data Request Detected - Outbound |
|
NDR Active Threat Intelligence |
2 |
| 56835 VID22518 Obfuscated Executable Embedded in MS Document Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 62725 VID140123 Suspicious Powershell Command Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 62727 VID348223 MaskGramStealer Malware Data Exfiltration - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57479 VID27057 Suspicious HTTP Request to .bazar TLD - Outbound |
|
NDR Active Threat Intelligence |
2 |
| 62729 VID355137 Suspicious HTTP Server Response Content Detected - Inbound (OtterCookie Malware Activity) |
|
NDR Active Threat Intelligence |
1 |
| 62732 VID342673 KongTuke Campaign ClickFix Finger Traffic - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 56590 VID367378 Bottle Exploit Kit Landing Page Redirect Request Detected - Outbound |
|
NDR Active Threat Intelligence |
2 |
| 57230 VID79296 Java Base64 Serialized Object C3P0 Class Detected - Inbound (Possible RCE Attempt) |
|
NDR Active Threat Intelligence |
2 |
| 62611 VID140123 Suspicious Powershell Command Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 62739 VID359726 GOGITTER Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62740 VID359548 PeckBirdy Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 55701 VID100669 Zebrocy Malware SSL Certificate Detected - Inbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 51863 VID66997 TeslaCrypt Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62744 VID140123 Suspicious Powershell Command Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 55067 VID101149 Metamorfo Campaign Banking Trojan C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62748 VID360419 Scoodle Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57627 VID19188 Warezov/Stration/Opnis Worm Attempting to Spread via Email - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62758 VID363687 Moonrise Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62759 VID363365 MIMICRAT Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62760 VID363687 Moonrise Malware C2 Command - Inbound |
|
NDR Active Threat Intelligence |
1 |
| 62761 VID364160 MarsSnake Backdoor C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62762 VID364151 Dohdoor Malware DNS-over-HTTPS Request - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 56107 VID31613 Blackshades Trojan Phoning Home |
|
NDR Active Threat Intelligence |
1 |
| 57004 VID14156 Powershell Command Invoke HTTP POST Request Detected - Inbound (Possible Webshell Activity) |
|
NDR Active Threat Intelligence |
2 |
| 62765 VID364151 Dohdoor Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62766 VID364351 GRIDTIDE Malware Download Attempt Detected - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 62767 VID363687 Moonrise Malware C2 Communication (Heartbeat) - Inbound |
|
NDR Active Threat Intelligence |
1 |
| 57901 VID36000 INetSim SSL Certificate Detected - Inbound (Sinkhole Traffic) |
|
NDR Active Threat Intelligence |
1 |
| 62769 VID200715 XWorm RAT Downloading Base64 Content in JPG File - Inbound |
|
NDR Active Threat Intelligence |
1 |
| 56499 VID66807 IP Check Site ident.me SSL Certificate Detected - Inbound (Possible Malware Connectivity Check) |
|
NDR Active Threat Intelligence |
2 |
| 62778 VID346866 N-able N-central Authenticated Limited File Write Attempt - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 55739 VID16863 Infostealer Malware Exfiltrating Screenshot Over FTP - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 55740 VID16863 Infostealer Malware Exfiltrating Data Over FTP - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62781 VID300039 COBALT ULSTER Red Alert App Impersonator Spyware C2 Communication - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 62782 VID300039 COBALT ULSTER Red Alert App Impersonator Spyware Exfiltrating Stolen Data - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 62783 VID366771 MuddyWater Dindoor Trojan C2 Communication - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 62784 VID366771 MuddyWater Dindoor Trojan C2 Communication - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 62785 VID333311 PylangGhost RAT C2 Communication - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 56510 VID315548 ASPX Webshell Request Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 62787 VID367361 PureLogStealer Malware User-Agent Detected - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62788 VID22518 Compromised Trivy C2 SSL Client Hello - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 56897 VID22518 Suspicious LNK File With Powershell Downloader Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 62790 VID367361 PureLogStealer Malware HTML Page Detected - Inbound |
|
NDR Active Threat Intelligence |
1 |
| 62791 VID105285 Node.js Child Process Execution via URI Parameter - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 56899 VID22518 Suspicious LNK File With Powershell Downloader Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 56900 VID22518 Suspicious XSL File Detected - Inbound (Possible Malware Downloader) |
|
NDR Active Threat Intelligence |
2 |
| 62801 VID373796 WAVESHAPER Second Stage Malware Download Attempt - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62802 VID374061 UAT-10608 Nexus Listener C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 55378 VID376099 Pteranodon Malware C2 Communication - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 56538 VID75511 Antak Webshell Command Detected - Inbound (Possible Webserver Compromise) |
|
NDR Active Threat Intelligence |
2 |
| 55771 VID21727 Tiny Webshell Encoded Script Detected - Inbound |
|
NDR Active Threat Intelligence |
2 |
| 62813 VID374060 EncystPHP Webshell Download Request - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 56031 VID16863 Infostealer Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62816 VID373117 Adobe Reader Trojan C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62818 VID198946 Lumma Infostealer Exfiltrating System Data - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62824 VID329305 AdaptixC2 Framework Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 56939 VID66807 Suspicious IP Connectivity Check to ip.42.pl - Outbound |
|
NDR Active Threat Intelligence |
2 |
| 56055 VID374184 Protos Malware Phoning Home |
|
NDR Active Threat Intelligence |
1 |
| 57594 VID16863 Infostealer Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57599 VID146118 Reserlo Malware IP Check - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 61473 VID107220 NoaBot Botnet hi SSH Scanning - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62726 VID348223 MaskGramStealer Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62728 VID348223 MaskGramStealer Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62730 VID342673 KongTuke Campaign Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62733 VID147642 HTTP GET Request For Mozi Malware Executable Detected - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62741 VID359548 PeckBirdy Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62745 VID22518 MintsLoader Malware Download Request - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 62746 VID361660 GhostWeaver RAT SSL/TLS Certificate Detected - Inbound |
|
NDR Active Threat Intelligence |
1 |
| 62755 VID281169 OysterLoader Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 30423 VID20594 Sality Virus Requesting Payload |
|
NDR Active Threat Intelligence |
1 |
| 35538 VID40205 Gamarue Trojan Phoning Home |
|
NDR Active Threat Intelligence |
1 |
| 48313 VID40205 Gamarue Downloader Trojan Phoning Home |
|
NDR Active Threat Intelligence |
1 |
| 49219 VID36000 Server Response with X-Sinkhole Header Detected |
|
NDR Active Threat Intelligence |
1 |
| 49471 VID54842 Stratum Bitcoin Mining Protocol Detected Outbound (AUP - Cryptomining) |
|
NDR Active Threat Intelligence |
2 |
| 50141 VID54842 Cryptocurrency Stratum Mining Pool Login Detected (AUP - Cryptomining) |
|
NDR Active Threat Intelligence |
2 |
| 51094 VID40205 Gamarue Andromeda Trojan Phoning Home |
|
NDR Active Threat Intelligence |
1 |
| 52235 VID72240 Tempedreve Malware Phone Home |
|
NDR Active Threat Intelligence |
1 |
| 52501 VID40205 Gamarue Andromeda Trojan Phone Home |
|
NDR Active Threat Intelligence |
1 |
| 52510 VID53430 njRAT Phone Home Detected (Possible APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 52986 VID20594 Sality Virus - .jpg HTTP Request Outbound |
|
NDR Active Threat Intelligence |
1 |
| 53061 VID40205 Gamarue Andromeda Trojan Phone Home |
|
NDR Active Threat Intelligence |
1 |
| 53147 VID40205 Gamarue Andromeda Trojan Phone Home |
|
NDR Active Threat Intelligence |
1 |
| 54579 VID54842 Cryptocurrency Stratum Mining Pool Login Detected - Outbound (AUP - Cryptomining) |
|
NDR Active Threat Intelligence |
2 |
| 54801 VID78296 TrickBot Malware Getting External IP From ipinfo.io |
|
NDR Active Threat Intelligence |
1 |
| 54807 VID78296 TrickBot Malware Getting External IP From ip.anysrc.net |
|
NDR Active Threat Intelligence |
1 |
| 54809 VID78296 TrickBot Malware Getting External IP From checkip.amazonaws.com |
|
NDR Active Threat Intelligence |
1 |
| 54810 VID78296 TrickBot Malware Getting External IP From api.ipify.org |
|
NDR Active Threat Intelligence |
1 |
| 54811 VID78296 TrickBot Malware Getting External IP From myexternalip.com |
|
NDR Active Threat Intelligence |
1 |
| 54812 VID78296 TrickBot Malware Getting External IP From ipecho.net |
|
NDR Active Threat Intelligence |
1 |
| 54813 VID78296 TrickBot Malware Getting External IP From wtfismyip.com |
|
NDR Active Threat Intelligence |
1 |
| 54814 VID78296 TrickBot Malware Getting External IP From icanhazip.com |
|
NDR Active Threat Intelligence |
1 |
| 54991 VID54842 Bitcoin Mining SSL Certificate - Inbound (AUP - Cryptomining) |
|
NDR Active Threat Intelligence |
2 |
| 55235 VID54842 Cryptocurrency Mining Worm C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 55415 VID108161 Floxif Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 56533 VID54842 XMRig Cryptocurrency Miner Mining Pool Login Detected (AUP - Cryptomining) |
|
NDR Active Threat Intelligence |
2 |
| 56831 VID127471 Phorpiex/Trik Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57372 VID121375 Suspicious User-Agent agent Detected (Possible DarkRat Malware Variant) - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57403 VID361526 MFC Malware IP Check - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 57404 VID361526 MFC Malware Phoning Home (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 57429 VID300035 COBALT ILLUSION Watering Hole Request Detected - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 57430 VID26693 Gootkit Trojan SSL Certificate Detected - Inbound |
|
NDR Active Threat Intelligence |
1 |
| 57473 VID360419 Scoodle Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57488 VID360028 209Loader Malware Retrieving Payload Location - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 57547 VID144898 XDSpy XDUpload Malware Plugin Phoning Home - Outbound (APT Activity) |
|
NDR Active Threat Intelligence |
1 |
| 57561 VID16863 Infostealer Malware C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57626 VID19188 Warezov/Stration/Opnis Worm C2 Communication - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 57644 VID13981 Malicious User Agent HttpSocket By Xswallow Detected - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 58023 VID75303 Suspicious Request to MinPic Image Sharing Site - Outbound (Malware Dowload Attempt) |
|
NDR Active Threat Intelligence |
1 |
| 58488 VID157267 STRRAT Malware Phoning Home - Outbound |
|
NDR Active Threat Intelligence |
1 |
| 59454 VID131628 Hikvision IP Camera Backdoor Usage Attempt - Inbound |
|
NDR Active Threat Intelligence |
2 |