""ET POLICY SSL Certificate IRC GEEKS Likely Encrypted IRC or CnC""

SID: 2019387

Revision: 3

Class Type: misc-activity

Metadata: attack_target Client_Endpoint, created_at 2014_10_10, deployment Perimeter, former_category POLICY, signature_severity Informational, tag SSL_Malicious_Cert, updated_at 2022_03_23

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "|16|"

  • Value: "|0b|"

  • Value: "|06 03 55 04 0a|"

  • Value: "|09|IRC geeks"

Within: 10

PCRE:

Special Options:

source