""ET INFO Observed File Transfer Service SSL/TLS Certificate (transfer .sh)""
SID: 2033076
Revision: 7
Class Type: misc-activity
Metadata: attack_target Client_and_Server, created_at 2021_06_03, deployment Perimeter, former_category TROJAN, performance_impact Low, signature_severity Informational, tag SSL_Malicious_Cert, updated_at 2024_07_08, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: 443
Destination Network: $HOME_NET
Destination Port: any
Flow: from_server,established
Contents:
-
Value: "|16|"
-
Value: "|0b|"
-
Value: "|06 03 55 04 03|"
-
Value: "|0b|transfer.sh"
Within: 12
PCRE:
Special Options:
- fast_pattern