Browse Rules

VShell connection attempt successful

VShell connection attempt successful

[EXTRAHOP] Cryptocurrency Mining Pool Connection Attempt

[EXTRAHOP] Cryptocurrency Mining Pool Connection Attempt

Anomalous User Agent connection attempt

'Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.'

[McAfee-Web-Gateway] High Risk Connection Attempt Detected

[McAfee-Web-Gateway] High Risk Connection Attempt Detected

OpenCanary - VNC Connection Attempt

Detects instances where a VNC service on an OpenCanary node has had a connection attempt.

OpenCanary - RDP New Connection Attempt

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

OpenCanary - SSH New Connection Attempt

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

telnetd: Multiple connection attempts from same source,(possible scan).

telnetd: Multiple connection attempts from same source,(possible scan).

vsftpd: FTP session opened.

vsftpd: FTP session opened.

Multiple query (cache) failures.

Multiple query (cache) failures.

MS-FTP: New FTP connection.

MS-FTP: New FTP connection.

sshd: insecure connection attempt (scan).

sshd: insecure connection attempt (scan).

sshd: insecure connection attempt (scan).

sshd: insecure connection attempt (scan).

proftpd: Multiple connection attempts from same source.

proftpd: Multiple connection attempts from same source.

pure-ftpd: Multiple connection attempts from same source.

pure-ftpd: Multiple connection attempts from same source.

vsftpd: Multiple FTP connection attempts from,same source IP.

vsftpd: Multiple FTP connection attempts from,same source IP.

VShell multiple connection attempts within 2 minute by a host in the deny file, potential DOS or brute force attempt.

VShell multiple connection attempts within 2 minute by a host in the deny file, potential DOS or brute force attempt.

Courier: Multiple connection attempts from same source.

Courier: Multiple connection attempts from same source.

SQL Server - Connection attempt using a disabled account

Detects scenarios where an attacker attempts authenticate to the database using a disabled user accont

Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt

This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with IDs 64797, 64798, 64799, 64800, 64801, 64167, 64168, 64169, 62709 have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.

Suspicious Network Connection Attempt by Root

Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process.

MS-FTP: Multiple connection attempts from same source.

MS-FTP: Multiple connection attempts from same source.

Potential CVE-2023-23397 Exploitation Attempt - SMB

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Potential CVE-2023-23397 Exploitation Attempt - SMB

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

pure-ftpd: New FTP connection.

pure-ftpd: New FTP connection.