Date Author Title

BOTNET RULES

2010-04-23Adrien de BeaupreShadowserver botnet rules

BOTNET

2024-02-18/a>Guy BruneauMirai-Mirai On The Wall... [Guest Diary]
2024-01-07/a>Guy BruneauSuspicious Prometei Botnet Activity
2023-12-27/a>Guy BruneauUnveiling the Mirai: Insights into Recent DShield Honeypot Activity [Guest Diary]
2023-11-27/a>Guy BruneauDecoding the Patterns: Analyzing DShield Honeypot Activity [Guest Diary]
2023-11-22/a>Guy BruneauCVE-2023-1389: A New Means to Expand Botnets
2023-11-09/a>Guy BruneauRouters Targeted for Gafgyt Botnet [Guest Diary]
2023-03-11/a>Xavier MertensOverview of a Mirai Payload Generator
2022-02-15/a>Xavier MertensWho Are Those Bots?
2021-11-26/a>Guy BruneauSearching for Exposed ASUS Routers Vulnerable to CVE-2021-20090
2021-10-04/a>Johannes UllrichBoutique "Dark" Botnet Hunting for Crumbs
2020-06-13/a>Guy BruneauMirai Botnet Activity
2019-08-14/a>Brad DuncanRecent example of MedusaHTTP malware
2019-07-26/a>Kevin ShorttDVRIP Port 34567 - Uptick
2018-12-23/a>Guy BruneauScanning Activity, end Goal is to add Hosts to Mirai Botnet
2017-05-08/a>Renato MarinhoExploring a P2P Transient Botnet - From Discovery to Enumeration
2016-12-07/a>Xavier MertensThe Passwords You Should Never Use
2016-09-10/a>Xavier MertensOngoing IMAP Scan, Anyone Else?
2016-07-27/a>Xavier MertensAnalyze of a Linux botnet client source code
2014-10-09/a>Johannes UllrichCSAM: My servers started speaking IRC, and that is when I started to listen!
2014-01-16/a>Kevin ShorttPort 4028 - Interesting Activity
2013-12-07/a>Guy BruneauSuspected Active Rovnix Botnet Controller
2011-02-28/a>Deborah HalePossible Botnet Scanning
2011-01-11/a>Kevin ShorttSpam Cannons on Holiday
2010-07-29/a>Rob VandenBrinkFBI, Slovenian and Spanish Police announce more arrests of Mariposa Botnet Creator, Operators
2010-04-23/a>Adrien de BeaupreShadowserver botnet rules
2009-12-21/a>Marcus SachsiPhone Botnet Analysis
2009-11-13/a>Deborah HalePushdo/Cutwail Spambot - A Little Known BIG Problem
2009-11-08/a>Kevin ListonFireEye takes on Ozdok and Recovery Ideas
2009-10-10/a>Tony CarothersUser Notification for Possible Infected Systems
2009-09-16/a>Raul SilesIETF Draft for Remediation of Bots in ISP Networks
2009-05-07/a>Deborah HaleBotnet hijacking reveals 70GB of stolen data
2008-09-01/a>John BambenekThe Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-07-19/a>William SaluskyA twist in fluxnet operations. Enter Hydraflux
2008-07-15/a>Maarten Van HorenbeeckBot controller mimicry
2008-04-07/a>John BambenekGot Kraken?
2008-04-07/a>John BambenekKraken Technical Details: UPDATED x3
2006-08-31/a>Swa FrantzenNT botnet submitted
2006-08-31/a>Joel EslerMS06-040 Worm

RULES

2022-02-26/a>Guy BruneauUsing Snort IDS Rules with NetWitness PacketDecoder
2020-08-20/a>Rob VandenBrinkOffice 365 Mail Forwarding Rules (and other Mail Rules too)
2020-06-19/a>Remco VerhoefSigma rules! The generic signature format for SIEM systems.
2018-06-21/a>Xavier MertensAre Your Hunting Rules Still Working?
2016-07-15/a>Xavier MertensName All the Things!
2010-04-23/a>Adrien de BeaupreShadowserver botnet rules