""ET TROJAN Windows set Microsoft Windows DOS prompt command exit OUTBOUND""

SID: 2019081

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2014_08_28, updated_at 2014_08_28

Reference:

• md5

• a22af4fc7fe011069704a15296634ca6

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

• Value: "ALLUSERSPROFILE="

• Value: "APPDATA="

• Value: "CLIENTNAME="

• Value: "CommonProgramFiles="

• Value: "COMPUTERNAME="

• Value: "ComSpec="

Within:

PCRE:

Special Options:

• fast_pattern

source