""ET TROJAN TransparentTribe Related CnC Activity""

SID: 2033962

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2021_09_16, malware_family TransparentTribe, updated_at 2021_09_16

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

• Value: "x999" Depth: 4

• Value: ">"

• Value: "|20|>>"

Within:

PCRE: "/>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}>/"

Special Options:

• fast_pattern

source