blob: 53d0330f13dd59f11a0a94cd5e39816cbea33dd9 (
plain)
1
2
3
4
5
6
7
8
9
|
DAEMON-EVENT: init
new: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80]
detected: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80] [HTTP.WindowsUpdate][Unknown][SoftwareUpdate][Safe][151.99.72.125]
RISK: HTTP/TLS/QUIC Numeric Hostname/SNI
detection-update: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80] [HTTP.WindowsUpdate][Unknown][Download][Safe][151.99.72.125]
RISK: HTTP/TLS/QUIC Numeric Hostname/SNI, Binary File/Data Transfer (Attempt)
idle: [.....1] [ip4][..tcp] [......10.0.2.15][49815] -> [..151.99.72.125][...80] [HTTP.WindowsUpdate][Unknown][Download][Safe][151.99.72.125]
RISK: HTTP/TLS/QUIC Numeric Hostname/SNI, Binary File/Data Transfer (Attempt)
DAEMON-EVENT: shutdown
|