""ET TROJAN Outbound POST Request with ps PowerShell Command Output""

SID: 2027210

Revision: 3

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_04_16, performance_impact Low, tag T1086, tag T1057, updated_at 2019_08_16

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "|48 61 6e 64 6c 65 73 20 20 4e 50 4d 28 4b 29 20 20 20 20 50 4d 28 4b 29 20 20 20 20 20 20 57 53 28 4b 29|"

Within:

PCRE:

Special Options:

• http_method

• http_client_body

source