""ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Command Tunneling M2""

SID: 2034863

Revision: 1

Class Type: misc-attack

Metadata: created_at 2022_01_10, updated_at 2022_01_10

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "host="

  • Value: "port="

  • Value: "request=|22|474554"

  • Value: "78705f636d647368656c6c"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • fast_pattern

source