""ET INFO Adilbo HTML Encoder Observed""

SID: 2024763

Revision: 4

Class Type: misc-activity

Metadata: affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_09_23, deployment Perimeter, signature_severity Informational, updated_at 2023_05_02, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation

Reference:

• Link

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "|2f 2a 20 61 64 69 6c 62 6f 20 48 54 4d 4c 20 45 6e 63 6f 64 65 72|"

• Value: "*|20 20|Checksum|3a 20|"

Within: 200

PCRE:

Special Options:

• file_data

source