Category: Radiflow
( 189 Alerts)NF – ISCSI – ISCSI auth message None – Mounted device on External net – Auth None used – Data in clear txt
This alert is triggered when an iSCSI authentication message with "AuthMethod=None" is detected from an external network to an internal device. This indicates that an iSCSI connection is being established with no authentication.
NF – ISCSI – ISCSI auth message None – Mounted device on Internal net – Auth None used – Data in clear txt
This alert is triggered when an iSCSI authentication message with "AuthMethod=None" is detected from an internal device to an external network. This indicates that an iSCSI connection is being established with no authentication.
NF – POLICY – Bitsadmin tool used to do downloads – BITS 4.0
This alert is triggered when the Bitsadmin tool is used to initiate an HTTP download from an internal network device. Bitsadmin, a command-line tool, is often used to transfer files and can be exploited by malware for data exfiltration or unauthorized downloads.
NF – Bad TLD domain – travel DNS query – Check domains
This alert is triggered when a DNS query from the internal network attempts to resolve a domain ending in .travel. This domain ending is sometimes linked to suspicious or malicious activities.
NF – Bad TLD domain – vip DNS query – Check domains
This alert is triggered when a DNS query from the internal network attempts to resolve a domain ending in .vip. This domain ending is sometimes linked to suspicious or malicious activities.
NF – Bad TLD domain – ml DNS query – Check domains
This alert is triggered when a DNS query from the internal network attempts to resolve a domain ending in .ml. This domain ending is sometimes linked to suspicious or malicious activities.
NF – Known Gamarue alias Andromeda BotNet – Unknown sinkhole owner
This alert is triggered when a device within the internal network attempts to establish a TCP connection with IP address 104.238.158.106, which is associated with the Gamarue (also known as Andromeda) botnet. This botnet is known for distributing malware and engaging in malicious activities.
NF – Known Gamarue alias Andromeda BotNet – Unknown sinkhole owner
This alert is triggered when a device within the internal network attempts to establish a TCP connection with IP address 204.11.56.48, which is associated with the Gamarue (also known as Andromeda) botnet. This botnet is known for distributing malware and engaging in malicious activities.
NF – POLICY – Teamviewer Master domain lookup
This alert is triggered when a DNS query from the internal network attempts to resolve a TeamViewer "master" domain, indicating that a device may be trying to establish a connection via TeamViewer.
NF – Web search engine – Yandex
This alert is triggered by traffic from the Yandex search engine.