""ET TROJAN Skeleton Key Filename in SMB2 Traffic""
SID: 2020383
Revision: 4
Class Type: trojan-activity
Metadata: created_at 2015_02_07, updated_at 2015_02_07
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: [139,445]
Flow: established,to_server
Contents:
-
Value: "|FE|SMB|40|" Depth: 5 Offset: 4
-
Value: "|12 00|"
-
Value: "o|00|l|00|e|00|6|00|4|00|.|00|d|00|l|00|l"
Within: 17
PCRE:
Special Options: