NetWork | ZeroBOX

Flow	SID	Signature	Category
TCP 187.45.240.69:80 -> 192.168.56.101:49216	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49215	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49217	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49221	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49214	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49229	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49224	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49225	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49227	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49237	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49235	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49233	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 187.45.240.69:80 -> 192.168.56.101:49246	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 192.168.56.101:49251 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49251 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49258 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49251 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49258 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49258 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 187.45.240.69:80 -> 192.168.56.101:49243	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 172.96.187.2:443 -> 192.168.56.101:49251	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 187.45.240.69:80 -> 192.168.56.101:49244	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 172.96.187.2:443 -> 192.168.56.101:49251	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49258	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49258	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 187.45.240.69:80 -> 192.168.56.101:49219	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 192.168.56.101:49259 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49264 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49259 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49247 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49264 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49259 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49264 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49247 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49247 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49264	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49264	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49259	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49248 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49259	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49248 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49248 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49266 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49266 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49266 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49262 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49247	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49262 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49247	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49262 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49266	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49266	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49248	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49248	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49262	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49262	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49249 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49272 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49249 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49272 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49249 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49272 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 187.45.240.69:80 -> 192.168.56.101:49241	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 172.96.187.2:443 -> 192.168.56.101:49249	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49272	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49249	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49272	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49250 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49288 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49250 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49254 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49288 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49250 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49254 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49288 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49254 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49288	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49250	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49254	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49288	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49250	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49254	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49269 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49252 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49269 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49260 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49252 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 187.45.240.69:80 -> 192.168.56.101:49238	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 192.168.56.101:49269 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49260 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49252 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49260 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49260	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49252	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49260	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49252	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49261 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 187.45.240.69:80 -> 192.168.56.101:49245	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 192.168.56.101:49261 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49253 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49261 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49253 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49253 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49261	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49261	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 187.45.240.69:80 -> 192.168.56.101:49218	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 192.168.56.101:49268 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49253	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49268 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49253	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49268 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49255 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49265 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49255 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49265 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49268	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49255 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49265 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49268	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49255	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49269	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49255	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49265	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49276 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49269	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49265	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49276 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49276 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49270 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49276	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49267 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49270 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49276	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49267 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49270 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49267 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49277 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49270	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49267	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49277 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49270	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 187.45.240.69:80 -> 192.168.56.101:49231	2026994	ET INFO PowerShell DownloadFile Command Common In Powershell Stagers	A Network Trojan was detected
TCP 192.168.56.101:49274 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49277 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49267	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49274 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49274 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49277	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49275 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49277	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49274	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49275 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49274	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49275 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49282 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49275	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49282 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49275	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49282 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49285 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49285 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49285 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49282	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49282	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49285	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49285	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49283 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49283 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49283 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49256 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49256 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49256 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49256	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49256	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49283	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49283	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49257 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49257 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49257 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49278 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49278 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49257	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49278 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49257	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49271 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49271 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49271 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49278	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49278	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49271	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49271	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49279 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49281 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49279 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49281 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49279 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49281 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49279	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49281	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49279	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49281	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49284 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49284 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49284 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49284	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49284	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49286 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49286 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49286 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49286	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49286	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49287 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49287 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49287 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49287	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49287	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49289 -> 172.96.187.2:443	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 192.168.56.101:49289 -> 172.96.187.2:443	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode
TCP 192.168.56.101:49289 -> 172.96.187.2:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.96.187.2:443 -> 192.168.56.101:49289	2230002	SURICATA TLS invalid record type	Generic Protocol Command Decode
TCP 172.96.187.2:443 -> 192.168.56.101:49289	2230010	SURICATA TLS invalid record/traffic	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts