blob: f1718be3460e6a8b3ff953bb6348cbf08d9ae84a (
plain)
1
2
3
4
5
6
7
8
9
|
DAEMON-EVENT: init
new: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80]
detected: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80] [HTTP.WindowsUpdate][Unknown][SoftwareUpdate][Safe][151.99.72.125]
RISK: HTTP/TLS/QUIC Numeric Hostname/SNI
detection-update: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80] [HTTP.WindowsUpdate][Unknown][Download][Safe][151.99.72.125]
RISK: Binary App Transfer, HTTP/TLS/QUIC Numeric Hostname/SNI
idle: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80] [HTTP.WindowsUpdate][Unknown][Download][Safe]
RISK: Binary App Transfer, HTTP/TLS/QUIC Numeric Hostname/SNI
DAEMON-EVENT: shutdown
|