""ET TROJAN IceApple User-Agent observed""
SID: 2036602
Revision: 1
Class Type: trojan-activity
Metadata: attack_target Server, created_at 2022_05_17, deployment Perimeter, deployment SSLDecrypt, malware_family IceApple, performance_impact Low, signature_severity Major, updated_at 2022_05_17
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: $HTTP_PORTS
Flow: established,to_server
Contents:
-
Value: "Microsoft Office/16.0 |28|Windows NT 10.0|3b 20|Microsoft Outlook 16.0.4551|3b 20|Pro|29|"
-
Value: !"Referer|3a 20|"
Within:
PCRE: "/^User-Agent\x3a\x20[^\r\n]+Microsoft Office\/16.0 \x28Windows NT 10.0\x3b Microsoft Outlook 16.0.4551\x3b Pro\x29/Hmi"
Special Options:
-
http_header
-
http_header