Hot answers tagged

2

Notice the magic string () { :; };. They are trying to poke around and see if your server is vulnerable to the ShellShock exploit. Perl is used here to print and see if the attack succeeded. Test if your server is vulnerable to ShellShock. If it's not, you are clear. See also: Is my server vulnerable to a perl exploit?


2

He's looking to do shellshock against you. The funny thing is that he misconfigured his attack. I do malware capture and his wget/fetch/etc fail because his package ain't there :-)


1

First, make sure auditing is enabled. How to enable Audit Failure logs in Active Directory? Next, use the Security Event Log, filter for account logon events. (You can start with 4624 (logon) and (4625 (logon failed)) Check out https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx?catid=1 and ...



Only top voted, non community-wiki answers of a minimum length are eligible