# Snort/Suricata Alert Log
# Generated from: suricata -r /captures/20260408-full.pcap -l /var/log/suricata/
# Alert output: fast.log format
# Time range: 2026-04-08 00:00:00 - 2026-04-08 23:59:59
# Sensor: ids-sensor-01.corp.local (eth0, 10Gbps tap)

04/08/2026-02:14:33.481922  [**] [1:2010935:3] ET SCAN Suspicious inbound to mySQL port 3306 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54821 -> 10.0.1.15:3306
04/08/2026-02:14:33.502118  [**] [1:2010935:3] ET SCAN Suspicious inbound to mySQL port 3306 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54822 -> 10.0.1.16:3306
04/08/2026-02:14:33.519744  [**] [1:2010935:3] ET SCAN Suspicious inbound to mySQL port 3306 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54823 -> 10.0.1.17:3306
04/08/2026-02:14:34.001337  [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54830 -> 10.0.1.15:5900
04/08/2026-02:14:34.022891  [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54831 -> 10.0.1.15:5901
04/08/2026-02:14:34.044562  [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54832 -> 10.0.1.16:5900
04/08/2026-02:14:34.310055  [**] [1:2010937:3] ET SCAN Suspicious inbound to MSSQL port 1433 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54840 -> 10.0.1.15:1433
04/08/2026-02:14:34.332718  [**] [1:2010937:3] ET SCAN Suspicious inbound to MSSQL port 1433 [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 198.51.100.47:54841 -> 10.0.1.16:1433
04/08/2026-02:14:34.801247  [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54850 -> 10.0.1.15:22
04/08/2026-02:14:34.823991  [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54851 -> 10.0.1.16:22
04/08/2026-02:14:34.845123  [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54852 -> 10.0.1.17:22
04/08/2026-02:14:35.102384  [**] [1:2002910:6] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54853 -> 10.0.1.18:22
04/08/2026-02:14:35.501982  [**] [1:2009582:3] ET SCAN NMAP OS Detection Probe [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54860 -> 10.0.1.15:443
04/08/2026-02:14:35.721004  [**] [1:2009582:3] ET SCAN NMAP OS Detection Probe [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 198.51.100.47:54861 -> 10.0.1.16:443
04/08/2026-08:32:11.441092  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 10.0.1.15:80 -> 198.51.100.47:49201
04/08/2026-08:32:14.223847  [**] [1:2019284:3] ET WEB_SERVER SQL Injection Attempt SELECT FROM [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49205 -> 10.0.1.15:80
04/08/2026-08:32:14.501238  [**] [1:2019284:3] ET WEB_SERVER SQL Injection Attempt SELECT FROM [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49206 -> 10.0.1.15:80
04/08/2026-08:32:15.003921  [**] [1:2006546:9] ET WEB_SERVER SQL Injection Attempt UNION SELECT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49210 -> 10.0.1.15:80
04/08/2026-08:32:15.221748  [**] [1:2006546:9] ET WEB_SERVER SQL Injection Attempt UNION SELECT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49211 -> 10.0.1.15:80
04/08/2026-08:32:15.502819  [**] [1:2006546:9] ET WEB_SERVER SQL Injection Attempt UNION SELECT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49212 -> 10.0.1.15:80
04/08/2026-08:32:16.113405  [**] [1:2016019:2] ET WEB_SERVER SQL Injection Attempt -- GET parameter with CONCAT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49215 -> 10.0.1.15:80
04/08/2026-08:32:17.802341  [**] [1:2019401:4] ET WEB_SERVER Possible SQL Injection -- boolean-based blind [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49220 -> 10.0.1.15:80
04/08/2026-08:32:18.091244  [**] [1:2019401:4] ET WEB_SERVER Possible SQL Injection -- boolean-based blind [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 198.51.100.47:49221 -> 10.0.1.15:80
04/08/2026-10:45:22.301892  [**] [1:2027865:2] ET DNS Query to a .tk domain - Pair Likely Being Used for Suspicious Activity [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.1.22:51423 -> 10.0.0.2:53
04/08/2026-10:45:23.112005  [**] [1:2027865:2] ET DNS Query to a .tk domain - Pair Likely Being Used for Suspicious Activity [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.1.22:51424 -> 10.0.0.2:53
04/08/2026-10:45:24.502381  [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51425
04/08/2026-10:45:25.001923  [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51426
04/08/2026-10:45:25.501284  [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51427
04/08/2026-10:45:26.201743  [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51428
04/08/2026-10:45:26.901502  [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51429
04/08/2026-10:45:28.113841  [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51430
04/08/2026-10:45:29.005172  [**] [1:2025012:3] ET DNS Long DNS TXT Record Response - Possible Covert Channel [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51431
04/08/2026-10:45:30.201847  [**] [1:2025012:3] ET DNS Long DNS TXT Record Response - Possible Covert Channel [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.22:51432
04/08/2026-14:22:07.501982  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44501 -> 10.0.1.10:22
04/08/2026-14:22:07.701234  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44502 -> 10.0.1.10:22
04/08/2026-14:22:07.901547  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44503 -> 10.0.1.10:22
04/08/2026-14:22:08.101872  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44504 -> 10.0.1.10:22
04/08/2026-14:22:08.301204  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44505 -> 10.0.1.10:22
04/08/2026-14:22:08.501831  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44506 -> 10.0.1.10:22
04/08/2026-14:22:08.701547  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44507 -> 10.0.1.10:22
04/08/2026-14:22:08.901283  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44508 -> 10.0.1.10:22
04/08/2026-14:22:09.101992  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44509 -> 10.0.1.10:22
04/08/2026-14:22:09.301748  [**] [1:2001219:20] ET SCAN Potential SSH Brute Force [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 203.0.113.88:44510 -> 10.0.1.10:22
04/08/2026-16:05:44.201384  [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49821 -> 185.243.115.84:8080
04/08/2026-16:05:45.301892  [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49822 -> 185.243.115.84:8080
04/08/2026-16:06:44.502713  [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49830 -> 185.243.115.84:8080
04/08/2026-16:07:44.701482  [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49841 -> 185.243.115.84:8080
04/08/2026-16:08:45.001247  [**] [1:2024897:4] ET MALWARE Win32/Emotet CnC Checkin [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:49855 -> 185.243.115.84:8080
04/08/2026-17:31:22.801345  [**] [1:2030471:2] ET POLICY TLS Certificate with Suspicious Subject (self-signed, CN=localhost) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 45.77.201.19:443 -> 10.0.1.30:50102
04/08/2026-17:31:23.102847  [**] [1:2030472:2] ET POLICY TLS SNI Mismatch with Certificate CN [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 45.77.201.19:443 -> 10.0.1.30:50103
04/08/2026-17:31:24.501293  [**] [1:2030475:1] ET JA3 Hash - Possible Cobalt Strike [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:50110 -> 45.77.201.19:443
04/08/2026-17:31:25.201847  [**] [1:2030475:1] ET JA3 Hash - Possible Cobalt Strike [**] [Classification: A Network Trojan was Detected] [Priority: 1] {TCP} 10.0.1.30:50111 -> 45.77.201.19:443

# --- FALSE POSITIVES: Normal traffic triggering overly broad rules ---

04/08/2026-09:15:02.102934  [**] [1:2013028:5] ET POLICY HTTP Request to a .onion Domain (via Proxy) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 3] {TCP} 10.0.1.50:52100 -> 10.0.0.5:8080
# NOTE: This is a user visiting a news article about Tor, not actual .onion access. URL contained "onion" in the path parameter.

04/08/2026-09:47:33.301284  [**] [1:2016149:3] ET INFO Possible SSRF - GET with Internal IP in URL Parameter [**] [Classification: Misc activity] [Priority: 3] {TCP} 10.0.1.55:52200 -> 10.0.1.15:80
# NOTE: Internal monitoring tool checking health endpoints. Expected behavior.

04/08/2026-11:02:18.401823  [**] [1:2210044:2] SURICATA STREAM reassembly overlap, different data [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 10.0.1.12:443 -> 10.0.1.60:54102
# NOTE: Load balancer TCP session reuse causing benign reassembly overlap.

04/08/2026-12:30:45.501293  [**] [1:2019284:3] ET WEB_SERVER SQL Injection Attempt SELECT FROM [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 10.0.1.55:52300 -> 10.0.1.15:80
# NOTE: Internal reporting tool generates SQL-like query strings in GET parameters. Confirmed false positive - whitelisted src.

04/08/2026-13:15:22.601847  [**] [1:2002911:6] ET SCAN Potential VNC Scan 5900-5920 [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 10.0.1.70:55100 -> 10.0.1.15:5900
# NOTE: IT admin using legitimate VNC to manage headless server. Known source IP in IT admin range (10.0.1.64/26).

04/08/2026-15:45:11.701582  [**] [1:2027865:2] ET DNS Query to a .tk domain - Pair Likely Being Used for Suspicious Activity [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.1.42:51500 -> 10.0.0.2:53
# NOTE: Marketing team accessing a legitimate partner's .tk website. Verified benign.

04/08/2026-18:22:05.801293  [**] [1:2025011:4] ET DNS Excessive NXDOMAIN Responses - Possible DNS Tunneling [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 10.0.0.2:53 -> 10.0.1.80:51600
# NOTE: Developer workstation running automated tests that generate many random subdomain lookups for load testing DNS infrastructure.

04/08/2026-19:10:33.901284  [**] [1:2013028:5] ET POLICY HTTP Request to a .onion Domain (via Proxy) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 3] {TCP} 10.0.1.90:52400 -> 10.0.0.5:8080
# NOTE: Another news-article false positive - URL path contains "onion-routing-explained"

04/08/2026-20:05:18.101847  [**] [1:2016019:2] ET WEB_SERVER SQL Injection Attempt -- GET parameter with CONCAT [**] [Classification: Web Application Attack] [Priority: 1] {TCP} 10.0.1.55:52500 -> 10.0.1.15:80
# NOTE: Same internal reporting tool as alert at 12:30:45. Recurring false positive.

04/08/2026-21:30:44.301582  [**] [1:2210044:2] SURICATA STREAM reassembly overlap, different data [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 10.0.1.12:443 -> 10.0.1.65:54300
# NOTE: Load balancer issue again - same root cause as 11:02:18 alert.
