SID: 2037850

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2022_07_29, deployment Perimeter, signature_severity Major, updated_at 2023_01_17

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "Server|3a 20|nginx/"

  • Value: "|0d 0a 0d 0a 7b 22|statusCode|22 3a 20 22|success|22 2c 20 22|cname|22 3a 20 22|__"

  • Value: "|22 2c 20 22|cdomain|22 3a 20 22|"

  • Value: "|22 2c 20 22|cvalue|22 3a 20 22|"

Within: 15

PCRE: "/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22\x7d$/R"

Special Options:

  • fast_pattern

source