""ET TROJAN Skeleton Key Filename in SMB2 Traffic""
SID: 2020384
Revision: 2
Class Type: trojan-activity
Metadata: created_at 2015_02_07, updated_at 2015_02_07
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: [139,445]
Flow: established,to_server
Contents:
-
Value: "|FE|SMB|40|" Depth: 5 Offset: 4
-
Value: "|0e 00|"
-
Value: "o|00|l|00|e|00|.|00|d|00|l|00|l"
Within: 13
PCRE:
Special Options: