""ET CURRENT_EVENTS [TW] EvilProxy AiTM Username Checkin""

SID: 2037849

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2022_07_29, deployment Perimeter, signature_severity Major, updated_at 2022_07_29

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "/?username=" Depth: 11

• Value: "|7b 22|visitorId|22 3a 22|" Depth: 14

• Value: "|22 2c 22|connect_token|22 3a 22|"

• Value: "|22 2c 22|connect_hash|22 3a 22|"

Within: 18

PCRE: "/^/?username=[a-zA-Z0-9.-]+@[a-zA-Z0-9.]+.[a-zA-Z]{2,3}$/U"

Special Options:

• http_method

• http_uri

• fast_pattern

• http_client_body

• http_client_body

• http_client_body

source