""ET ATTACK_RESPONSE Metasploit Meterpreter Reverse HTTPS certificate""

SID: 2021178

Revision: 6

Class Type: trojan-activity

Metadata: affected_product Any, attack_target Client_and_Server, created_at 2015_06_03, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2019_03_13

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

  • Value: "|A3 0D 30 0B 30 09 06 03 55 1D 13 04 02 30 00|"

  • Value: "|16 03 03|"

  • Value: "|30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 30|"

  • Value: "|30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82|"

  • Value: "|02 03 01 00 01 A3 0D 30 0B 30 09 06 03 55 1D 13 04 02 30 00 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00|"

  • Value: !"|06|ubuntu"

  • Value: !"|04|mint"

  • Value: !"|a9 d5 73 d2 a0 a5 a1 69|"

Within: 36

PCRE: "/^...\x30\x82..\x02\x82...{256,257}/Rs"

Special Options:

source