""ET TROJAN Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (ASCII)""

SID: 2021179

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2015_06_04, updated_at 2015_06_04

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: any

Destination Port: [139,445]

Flow: to_server,established

Contents:

  • Value: "SMB" Depth: 4 Offset: 5

  • Value: "{AA0EED25-4167-4CBB-BDA8-9A0F5FF93EA8}"

Within:

PCRE:

Special Options:

  • nocase

source