SID: 2039832

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2022_11_23, deployment Perimeter, signature_severity Major, updated_at 2022_11_23

Reference:

  • md5

  • 2a90a42a4f379fb4a28bb32a96f8fc0f

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "User-Agent|3a 20|Mozilla/5.0 (Windows NT 10.0|3b 20|Win64|3b 20|x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36/"

Within:

PCRE: "/\x20Safari\/537.36\/[A-Za-z0-9]{17}\r\n/H"

Special Options:

  • http_header

source