""ET TROJAN Windows ipconfig Microsoft Windows DOS prompt command exit OUTBOUND""

SID: 2019000

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2014_08_26, updated_at 2014_08_26, reviewed_at 2024_03_20

Reference:

  • md5

  • a22af4fc7fe011069704a15296634ca6

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "Windows IP Configuration|0d|"

  • Value: "Ethernet adapter Local Area Connection|3a|"

  • Value: "Physical Address"

  • Value: "IP Address"

  • Value: "Subnet Mask"

  • Value: "Default Gateway"

Within:

PCRE:

Special Options:

source