""ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)""

SID: 2027761

Revision: 4

Class Type: misc-activity

Metadata: attack_target Client_Endpoint, created_at 2019_07_26, deployment Perimeter, malware_family AnyDesk, performance_impact Low, signature_severity Informational, tag RemoteAccessTool, updated_at 2023_05_17

Reference:

• Link

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: [80,443,6568]

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "|16|"

• Value: "|0b|"

• Value: "|06 03 55 04 06|"

• Value: "|02|DE"

• Value: "|06 03 55 04 0a|"

• Value: "|17|philandro Software GmbH"

• Value: "|06 03 55 04 03|"

• Value: "|0c|AnyNet Relay"

Within: 13

PCRE:

Special Options:

• fast_pattern

source