# Snort/Suricata Alert Log # Generated from: suricata -r /captures/20260408-full.pcap -l /var/log/suricata/ # Alert output: fast.log format # Time range: 2026-04-08 00:00:00 - 2026-04-08 23:59:59 # Sensor: ids-sensor-01.corp.local (eth0, 10Gbps tap) 04/08/2026-02:14:33.481922 [**] [1:2010935:3] ET SCAN Suspicious inbound to mySQL port 3306 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54821 -> 10.0.1.15:3306 04/08/2026-02:14:33.502118 [**] [1:2010935:3] ET SCAN Suspicious inbound to mySQL port 3306 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54822 -> 10.0.1.16:3306 04/08/2026-02:14:33.519744 [**] [1:2010935:3] ET SCAN Suspicious inbound to mySQL port 3306 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54823 -> 10.0.1.17:3306 04/08/2026-02:14:34.001337 [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54830 -> 10.0.1.15:5900 04/08/2026-02:14:34.022891 [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54831 -> 10.0.1.15:5901 04/08/2026-02:14:34.044562 [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54832 -> 10.0.1.16:5900 04/08/2026-02:14:34.310055 [**] [1:2010937:3] ET SCAN Suspicious inbound to MSSQL port 1433 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54840 -> 10.0.1.15:1433 04/08/2026-02:14:34.332718 [**] [1:2010937:3] ET SCAN Suspicious inbound to MSSQL port 1433 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54841 -> 10.0.1.16:1433 04/08/2026-02:14:34.801247 [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54850 -> 10.0.1.15:22 04/08/2026-02:14:34.823991 [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54851 -> 10.0.1.16:22 04/08/2026-02:14:34.845123 [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54852 -> 10.0.1.17:22 04/08/2026-02:14:35.102384 [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54853 -> 10.0.1.18:22 04/08/2026-02:14:35.501982 [**] [1:2009582:3] ET SCAN NMAP OS Detection Probe [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54860 -> 10.0.1.15:443 04/08/2026-02:14:35.721004 [**] [1:2009582:3] ET SCAN NMAP OS Detection Probe [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54861 -> 10.0.1.16:443 04/08/2026-08:32:11.441092 [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 10.0.1.15:80 -> 198.51.100.47:49201 04/08/2026-08:32:14.223847 [**] [1:2019284:3] ET WEB_SERVER SQL Injection Attempt SELECT FROM [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49205 -> 10.0.1.15:80 04/08/2026-08:32:14.501238 [**] [1:2019284:3] ET WEB_SERVER SQL Injection Attempt SELECT FROM [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49206 -> 10.0.1.15:80 04/08/2026-08:32:15.003921 [**] [1:2006546:9] ET WEB_SERVER SQL Injection Attempt UNION SELECT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49210 -> 10.0.1.15:80 04/08/2026-08:32:15.221748 [**] [1:2006546:9] ET WEB_SERVER SQL Injection Attempt UNION SELECT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49211 -> 10.0.1.15:80 04/08/2026-08:32:15.502819 [**] [1:2006546:9] ET WEB_SERVER SQL Injection Attempt UNION SELECT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49212 -> 10.0.1.15:80 04/08/2026-08:32:16.113405 [**] [1:2016019:2] ET WEB_SERVER SQL Injection Attempt -- GET parameter with CONCAT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49215 -> 10.0.1.15:80 04/08/2026-08:32:17.802341 [**] [1:2019401:4] ET WEB_SERVER Possible SQL Injection -- boolean-based blind [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49220 -> 10.0.1.15:80 04/08/2026-08:32:18.091244 [**] [1:2019401:4] ET WEB_SERVER Possible SQL Injection -- boolean-based blind [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49221 -> 10.0.1.15:80 04/08/2026-10:45:22.301892 [**] [1:2027865:2] ET DNS Query to a .tk domain - Pair Likely Being Used for Suspicious Activity [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.1.22:51423 -> 10.0.0.2:53 04/08/2026-10:45:23.112005 [**] [1:2027865:2] ET DNS Query to a .tk domain - Pair Likely Being Used for Suspicious Activity [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.1.22:51424 -> 10.0.0.2:53 04/08/2026-10:45:24.502381 [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51425 04/08/2026-10:45:25.001923 [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51426 04/08/2026-10:45:25.501284 [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51427 04/08/2026-10:45:26.201743 [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51428 04/08/2026-10:45:26.901502 [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51429 04/08/2026-10:45:28.113841 [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51430 04/08/2026-10:45:29.005172 [**] [1:2025012:3] ET DNS Long DNS TXT Record Response - Possible Covert Channel [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51431 04/08/2026-10:45:30.201847 [**] [1:2025012:3] ET DNS Long DNS TXT Record Response - Possible Covert Channel [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51432 04/08/2026-14:22:07.501982 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44501 -> 10.0.1.10:22 04/08/2026-14:22:07.701234 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44502 -> 10.0.1.10:22 04/08/2026-14:22:07.901547 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44503 -> 10.0.1.10:22 04/08/2026-14:22:08.101872 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44504 -> 10.0.1.10:22 04/08/2026-14:22:08.301204 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44505 -> 10.0.1.10:22 04/08/2026-14:22:08.501831 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44506 -> 10.0.1.10:22 04/08/2026-14:22:08.701547 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44507 -> 10.0.1.10:22 04/08/2026-14:22:08.901283 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44508 -> 10.0.1.10:22 04/08/2026-14:22:09.101992 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44509 -> 10.0.1.10:22 04/08/2026-14:22:09.301748 [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44510 -> 10.0.1.10:22 04/08/2026-16:05:44.201384 [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49821 -> 185.243.115.84:8080 04/08/2026-16:05:45.301892 [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49822 -> 185.243.115.84:8080 04/08/2026-16:06:44.502713 [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49830 -> 185.243.115.84:8080 04/08/2026-16:07:44.701482 [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49841 -> 185.243.115.84:8080 04/08/2026-16:08:45.001247 [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49855 -> 185.243.115.84:8080 04/08/2026-17:31:22.801345 [**] [1:2030471:2] ET POLICY TLS Certificate with Suspicious Subject (self-signed, CN=localhost) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 45.77.201.19:443 -> 10.0.1.30:50102 04/08/2026-17:31:23.102847 [**] [1:2030472:2] ET POLICY TLS SNI Mismatch with Certificate CN [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 45.77.201.19:443 -> 10.0.1.30:50103 04/08/2026-17:31:24.501293 [**] [1:2030475:1] ET JA3 Hash - Possible Cobalt Strike [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:50110 -> 45.77.201.19:443 04/08/2026-17:31:25.201847 [**] [1:2030475:1] ET JA3 Hash - Possible Cobalt Strike [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:50111 -> 45.77.201.19:443 # --- FALSE POSITIVES: Normal traffic triggering overly broad rules --- 04/08/2026-09:15:02.102934 [**] [1:2013028:5] ET POLICY HTTP Request to a .onion Domain (via Proxy) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 3] {TCP} 10.0.1.50:52100 -> 10.0.0.5:8080 # NOTE: This is a user visiting a news article about Tor, not actual .onion access. URL contained "onion" in the path parameter. 04/08/2026-09:47:33.301284 [**] [1:2016149:3] ET INFO Possible SSRF - GET with Internal IP in URL Parameter [**] [Classification: Misc activity] [Priority: 3] {TCP} 10.0.1.55:52200 -> 10.0.1.15:80 # NOTE: Internal monitoring tool checking health endpoints. Expected behavior. 04/08/2026-11:02:18.401823 [**] [1:2210044:2] SURICATA STREAM reassembly overlap, different data [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 10.0.1.12:443 -> 10.0.1.60:54102 # NOTE: Load balancer TCP session reuse causing benign reassembly overlap. 04/08/2026-12:30:45.501293 [**] [1:2019284:3] ET WEB_SERVER SQL Injection Attempt SELECT FROM [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 10.0.1.55:52300 -> 10.0.1.15:80 # NOTE: Internal reporting tool generates SQL-like query strings in GET parameters. Confirmed false positive - whitelisted src. 04/08/2026-13:15:22.601847 [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 10.0.1.70:55100 -> 10.0.1.15:5900 # NOTE: IT admin using legitimate VNC to manage headless server. Known source IP in IT admin range (10.0.1.64/26). 04/08/2026-15:45:11.701582 [**] [1:2027865:2] ET DNS Query to a .tk domain - Pair Likely Being Used for Suspicious Activity [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.1.42:51500 -> 10.0.0.2:53 # NOTE: Marketing team accessing a legitimate partner's .tk website. Verified benign. 04/08/2026-18:22:05.801293 [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.80:51600 # NOTE: Developer workstation running automated tests that generate many random subdomain lookups for load testing DNS infrastructure. 04/08/2026-19:10:33.901284 [**] [1:2013028:5] ET POLICY HTTP Request to a .onion Domain (via Proxy) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 3] {TCP} 10.0.1.90:52400 -> 10.0.0.5:8080 # NOTE: Another news-article false positive - URL path contains "onion-routing-explained" 04/08/2026-20:05:18.101847 [**] [1:2016019:2] ET WEB_SERVER SQL Injection Attempt -- GET parameter with CONCAT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 10.0.1.55:52500 -> 10.0.1.15:80 # NOTE: Same internal reporting tool as alert at 12:30:45. Recurring false positive. 04/08/2026-21:30:44.301582 [**] [1:2210044:2] SURICATA STREAM reassembly overlap, different data [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 10.0.1.12:443 -> 10.0.1.65:54300 # NOTE: Load balancer issue again - same root cause as 11:02:18 alert.