EHSU.zip| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Nov. 7, 2023, 9:43 a.m. | Nov. 7, 2023, 9:45 a.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.ssl.com | 3.213.199.135 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49171 -> 167.235.241.120:80 | 2013028 | ET POLICY curl User-Agent Outbound | Attempted Information Leak |
| TCP 192.168.56.102:49171 -> 167.235.241.120:80 | 2034567 | ET HUNTING curl User-Agent to Dotted Quad | Potentially Bad Traffic |
| TCP 192.168.56.102:49170 -> 167.235.241.120:80 | 2013028 | ET POLICY curl User-Agent Outbound | Attempted Information Leak |
| TCP 192.168.56.102:49170 -> 167.235.241.120:80 | 2034567 | ET HUNTING curl User-Agent to Dotted Quad | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
| suspicious_features | Connection to IP address | suspicious_request | GET http://167.235.241.120/jogX/Olluc | ||||||
| request | GET http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt |
| request | GET http://167.235.241.120/jogX/Olluc |
| host | 167.235.241.120 | |||