""ET TROJAN LinPEAS Privilege Escalation Script Response (With Banner)""

SID: 2037229

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Linux, attack_target Client_and_Server, created_at 2022_06_30, deployment Perimeter, deployment Internal, signature_severity Major, updated_at 2022_06_30

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: any

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "|0a 20 20 20 20 1b 5b 31 3b 33 32 6d 2f 2d 2d 2d|" Depth: 16

  • Value: "Do|20|you|20|like|20|PEASS|3f|"

Within: 30

PCRE:

Special Options:

  • fast_pattern

source