Victim IP
|
Max Score
|
Profiles
|
CCs
|
Events
|
192.168.1.223
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/19/2/0): 445:19
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.233
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.180
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
|
192.168.1.175
|
3.0 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-4441
- 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->1829
- 1:3300004 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031<-1829
|
192.168.1.202
|
1.4 |
VIEW 5 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 1:22000046 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k) MAC_Dst: 00:30:48:30:03:AE; 445<-43017
- 1:22314 (3) {tcp} Inbound Attack: GPL SHELLCODE x86 0x90 NOOP unicode MAC_Dst: 00:30:48:30:03:AE; 445<-43017
- 1:22514 (2) {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-43017
- 1:2653 (3) {tcp} Inbound Attack: GPL SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-43017
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.247
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
|
192.168.1.190
|
1.4 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
- 1:2537 (2) {tcp} Inbound Attack: GPL NETBIOS SMB IPC$ share access MAC_Dst: 00:30:48:30:03:AE; 139<-63552
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/2/0): 445:25
|
192.168.1.206
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.149
|
2.7 |
VIEW 9 |
|
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-1374
- 1:22000033 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-1374
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-1374
- 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->3007
- 1:2003070 {tcp} C&C Communication: ET WORM Korgo.U Reporting, [/index.php?id=ajeqktpvnuuafsxdo&scn=0&inf=0&ver=19&cnt=USA]; 1032->80
- 1:9920003 {tcp} Bot Space Access: BotHunter MTC confirmed botnet control server on standard port
- 1:2003070 {tcp} C&C Communication: ET WORM Korgo.U Reporting, [/index.php?id=ajeqktpvnuuafsxdo&scn=0&inf=0&ver=19&cnt=USA]; 1032->80
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3540
- 1:22000046 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k) MAC_Dst: 00:30:48:30:03:AE; 445<-3540
- 1:2003070 {tcp} C&C Communication: ET WORM Korgo.U Reporting, [/index.php?id=ktghblfbnqg&scn=0&inf=0&ver=19&cnt=USA]; 1032->80
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
|
192.168.1.215
|
1.4 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 1:22351 {tcp} Inbound Attack: REGISTERED FREE NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode MAC_Dst: 00:30:48:30:03:AE; 135<-4313
|
192.168.1.174
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.155
|
1.9 |
VIEW 8 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
- 1:22000346 (2) {tcp} Inbound Attack: ET ATTACK_RESPONSE IRC - Name response on non-std port MAC_Dst: 00:30:48:30:03:AE; 27213<-3308
- 1:2000352 {tcp} Attack Prep: ET ATTACK RESPONSE IRC - dns request on non-std port; 27213->3308
- 1:22000346 {tcp} Inbound Attack: ET ATTACK_RESPONSE IRC - Name response on non-std port MAC_Dst: 00:30:48:30:03:AE; 27213<-3308
|
192.168.1.201
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.235
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.158
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 135:20
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 27 IPs (27 /24s) (# pkts S/M/O/I=0/25/2/0): 135:25
|
192.168.1.210
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.133
|
1.4 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 1:22000032 (2) {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3036
- 1:22000046 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k) MAC_Dst: 00:30:48:30:03:AE; 445<-3036
- 1:22314 (5) {tcp} Inbound Attack: GPL SHELLCODE x86 0x90 NOOP unicode MAC_Dst: 00:30:48:30:03:AE; 445<-3036
|
192.168.1.205
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.255
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.243
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.203
|
3.5 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-15425
- 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->4995
- 1:3300004 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031<-4995
|
192.168.1.246
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.160
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.46
|
1.6 |
VIEW 43 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (6 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
- 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 46379->22
- 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 37043->22
- 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 46433->22
- 1:2003068 (2) {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 46379->22
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 43 IPs (25 /24s) (# pkts S/M/O/I=0/43/0/0): 22:43
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
- 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 36165->22
- 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 36849->22
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 44 IPs (26 /24s) (# pkts S/M/O/I=0/44/0/0): 22:44
- 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 37525->22
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (9 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 16 IPs (11 /24s) (# pkts S/M/O/I=0/16/0/0): 22:16
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 24 IPs (16 /24s) (# pkts S/M/O/I=0/24/0/0): 22:24
- 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 39176->22
- 777:7777008 (2) {tcp} Malware Scan: Detected intense malware port scanning of 43 IPs (25 /24s) (# pkts S/M/O/I=0/43/0/0): 22:43
- 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 39404->22
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 45 IPs (27 /24s) (# pkts S/M/O/I=0/44/1/0): 22:44
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 37 IPs (24 /24s) (# pkts S/M/O/I=0/37/0/0): 22:37
|
192.168.1.36
|
0.8 |
VIEW 21 |
|
- 1:9930009 {tcp} Bot Space Access: ET ShadowServer confirmed botnet control server on non-standard port
- 1:9930020 {udp} Bot Space Access: ET ShadowServer confirmed botnet control server on non-standard port
|
192.168.1.249
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.142
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.195
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.237
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.214
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.177
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.135
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.178
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.130
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.179
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (9 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (20 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.159
|
2.4 |
VIEW 4 |
|
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-4571
- 1:22000033 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-4571
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-4571
- 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->5703
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-2226
- 1:22000033 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-2226
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-2226
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.191
|
2.4 |
VIEW 2 |
|
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3478
- 1:22000033 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-3478
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-3478
- 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->695
|
192.168.1.164
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.129
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.248
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.209
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.245
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.100
|
1.9 |
VIEW 1 |
- 199.255.189.160 199.255.189.160 , , , .
- 199.255.189.60 199.255.189.60 , , , .
- 216.239.32.25 216.239.32.25 , , , .
- 216.239.38.25 216.239.38.25 , , , .
- 67.21.67.66 67.21.67.66 , , , .
- 95.83.47.248 95.83.47.248 , , , .
- 8.5.1.45 8.5.1.45 , , , .
|
- 1:2013036 (3) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 32853<-80
- 1:2013036 (3) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 52370<-80
- 1:2013036 (6) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 45509<-80
- 1:2013036 (6) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 36082<-80
- 1:2013036 (5) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 43180<-80
- 1:2012801 (2) {tcp} C&C Communication: ET TROJAN Spoofed MSIE 7 User-Agent Likely Ponmocup, [/filtered_reviews/Rg5oDRbHbZrmJ_qq7V8KEg?fsid=4gQ4QbEyDzI1Lg10M5zPVw&filtered_start=0]; 54107->80
|
192.168.1.166
|
1.1 |
VIEW 5 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
|
192.168.1.150
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.207
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.208
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.134
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.218
|
3.5 |
VIEW 2 |
|
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3524
- 1:22000033 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-3524
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-3524
- 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->5040
|
192.168.1.141
|
1.1 |
VIEW 4 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/1/0): 445:25
|
192.168.1.176
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.254
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.138
|
1.1 |
VIEW 6 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/1/0): 445:25
|
192.168.1.194
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.184
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.251
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.252
|
1.1 |
VIEW 4 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.227
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.244
|
1.4 |
VIEW 7 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3554
- 1:22000046 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k) MAC_Dst: 00:30:48:30:03:AE; 445<-3554
- 1:22314 (5) {tcp} Inbound Attack: GPL SHELLCODE x86 0x90 NOOP unicode MAC_Dst: 00:30:48:30:03:AE; 445<-3554
- 1:22514 (2) {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-3554
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.253
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.192
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.136
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.145
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.212
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.131
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.182
|
1.3 |
VIEW 4 |
|
- 1:22351 {tcp} Inbound Attack: REGISTERED FREE NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode MAC_Dst: 00:30:48:30:03:AE; 135<-6942
- 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 1031->707
- 1:1444 (2) {udp} Egg Download: TFTP GET from external source; 1032->69
- 1:2008120 (2) {udp} Egg Download: ET POLICY Outbound TFTP Read Request; 1032->69
- 1:3001441 (2) {udp} Egg Download: TFTP GET .exe from external source; 1032->69
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.154
|
1.1 |
VIEW 7 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.151
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.188
|
1.1 |
VIEW 4 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/2/0): 445:25
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/3/0): 445:25
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.232
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.186
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 135:20
|
192.168.1.153
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.144
|
1.4 |
VIEW 8 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 1:22000046 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k) MAC_Dst: 00:30:48:30:03:AE; 445<-3193
- 1:22314 (5) {tcp} Inbound Attack: GPL SHELLCODE x86 0x90 NOOP unicode MAC_Dst: 00:30:48:30:03:AE; 445<-3193
- 1:22514 (2) {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-3193
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-2132
- 1:22000046 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k) MAC_Dst: 00:30:48:30:03:AE; 445<-2132
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/1/0): 135:25
|
192.168.1.216
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.197
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.225
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.226
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 25 IPs (25 /24s) (# pkts S/M/O/I=0/24/4/0): 445:24
|
192.168.1.170
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 135:20
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.128
|
1.1 |
VIEW 9 |
|
- 1:22465 (2) {tcp} Inbound Attack: GPL NETBIOS SMB-DS IPC$ share access MAC_Dst: 00:30:48:30:03:AE; 445<-1729
- 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 1130->2003
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/1/0): 135:25
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 26 IPs (26 /24s) (# pkts S/M/O/I=0/25/1/0): 445:25
|
192.168.1.139
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 25 IPs (25 /24s) (# pkts S/M/O/I=0/24/1/0): 135:24
|
192.168.1.167
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/0/1): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/0/1): 135:20
|
192.168.1.171
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
|
192.168.1.224
|
1.1 |
VIEW 3 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.137
|
1.4 |
VIEW 1 |
|
- 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-4295
- 1:22000046 {tcp} Inbound Attack: ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k) MAC_Dst: 00:30:48:30:03:AE; 445<-4295
- 1:22314 (5) {tcp} Inbound Attack: GPL SHELLCODE x86 0x90 NOOP unicode MAC_Dst: 00:30:48:30:03:AE; 445<-4295
- 1:22514 (2) {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-4295
- 1:2653 (5) {tcp} Inbound Attack: GPL SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-4295
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
|
192.168.1.230
|
2.4 |
VIEW 2 |
|
- 1:22514 {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-1554
- 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->4390
- 1:3300004 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031<-4390
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:10
|
192.168.1.85
|
1.0 |
VIEW 3 |
|
- 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->34427
- 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->34427
- 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->31417
- 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->27671
- 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->8011
- 1:552123 (2) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->49697
- 1:2002033 (2) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->31417
|
192.168.1.156
|
2.4 |
VIEW 3 |
|
- 1:22514 (2) {tcp} Inbound Attack: GPL NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt MAC_Dst: 00:30:48:30:03:AE; 445<-11753
- 1:2000047 {tcp} Egg Download: ET WORM Sasser Transfer _up.exe; 9996<-12879
- 1:22001056 {tcp} Inbound Attack: ET WORM W32/Sasser.worm.b MAC_Dst: 00:30:48:30:03:AE; 1033<-13288
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/2/0): 445:9, 5554
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.187
|
1.1 |
VIEW 1 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
|
192.168.1.198
|
1.1 |
VIEW 2 |
|
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21
- 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 135:10
- 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 135:20
|
192.168.1.102
|
1.9 |
VIEW 2 |
- 88.212.196.87 88.212.196.87 , , , .
- 217.199.217.100 217.199.217.100 , , , .
- 8.5.1.45 8.5.1.45 , , , .
- 199.255.189.60 199.255.189.60 , , , .
- 208.95.172.130 208.95.172.130 , , , .
|
- 1:2013036 {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 40508<-80
- 1:2013036 (5) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 55309<-80
- 1:2013036 (2) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 49591<-80
- 1:2013036 (4) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 51017<-80
- 1:2013036 (5) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 36766<-80
- 1:3810007 (3) {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain, [q%86%B7$D%EF%A9Z%C4@bf%09?%15%90%C36%1C%C1%C3%11%F0%16%A6%0E@%89%B3t%CFz%88%D0p%FAA%F0%90%AE%14%AF%D1Y%C9:1%A5S%DC^%85%E3%E2]; 38675->80
- 1:2013036 (2) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 40508<-80
- 1:2013036 (5) {tcp} Egg Download: ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby; 56021<-80
|