""ET TROJAN UNC2628 BEACON Activity (GET)""

SID: 2033149

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2021_06_17, deployment Perimeter, deployment SSLDecrypt, signature_severity Major, tag c2, updated_at 2021_06_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel

Reference:

  • md5

  • 5f1e9ae81c6a3797bf16b9ee469dc66a

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: ".html|20|/"

  • Value: ".html?auth=uid"

  • Value: "ms-office|3b 20|"

  • Value: !"Referer|3a 20|"

  • Value: !"Accept"

Within:

PCRE: "/^User-Agent\x3a\x20[^\r\n]+ms-office\x3b\x20/Hmi"

Special Options:

  • http_method

  • http_uri

  • fast_pattern

  • http_uri

  • http_header

  • http_header

  • http_header

source