Boss-Key Screens

TCP: ----- Transmission Control Protocol -----

TCP: Destination Port = 445 (microsoft-ds / SMB)

TCP: Flags = ....S. (SYN) -- high-rate host sweep

TCP: [Conficker/Downadup -- MS08-067, CVE-2008-4250]

HTTP: ----- Hypertext Transfer Protocol -----

HTTP: Status-Line = HTTP/1.1 420 Enhance your calm

HTTP: Content-Type = application/json

HTTP: Retry-After = 60

HTTP: (rate limited; Twitter Search/Trends v1.0 API)

HTTP: Body = {"errors":[{"message":"Enhance your calm","code":420}]}

SMTP: ----- Simple Mail Transfer Protocol -----

SMTP: From = <current-user>@example.com

SMTP: Subject = ILOVEYOU

SMTP: Body = kindly check the attached LOVELETTER coming from me.

SMTP: Attachment = LOVE-LETTER-FOR-YOU.TXT.vbs

SMTP: (VBS/LoveLetter, spreads via Outlook address book)

TCP: ----- Transmission Control Protocol -----

TCP: Destination Port = 23 (telnet)

TELNET: ----- Telnet Protocol -----

TELNET: Login prompt / credential guess

TELNET: [Mirai -- IoT Telnet brute force; credential list omitted]

IP: ----- Internet Protocol -----

IP: Protocol = 6 (TCP)

TCP: ----- Transmission Control Protocol -----

TCP: Destination Port = 79 (finger)

TCP: Flags = ....S. (SYN)

TCP: [Internet Worm of 1988 -- fingerd + sendmail debug vectors]

TCP: ----- Transmission Control Protocol -----

TCP: Destination Port = 445 (microsoft-ds / SMBv1)

SMB: ----- Server Message Block v1 -----

SMB: Command = Negotiate / Tree Connect

SMB: [NotPetya -- EternalBlue, MS17-010; wiper]

TCP: ----- Transmission Control Protocol -----

TCP: Destination Port = 445 (microsoft-ds / SMB)

SMB: ----- Server Message Block -----

SMB: Command = Tree Connect (print spooler share)

SMB: [Stuxnet -- MS10-061 spooler + MS08-067; target: WinCC]

TCP: ----- Transmission Control Protocol -----

TCP: Destination Port = 445 (microsoft-ds / SMBv1)

SMB: ----- Server Message Block v1 -----

SMB: Command = Negotiate / Session Setup

SMB: [WannaCry -- EternalBlue, MS17-010, CVE-2017-0144]