SID: 2043332

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2023_01_17, updated_at 2023_01_18

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "Server|3a 20|nginx/"

  • Value: "|0d 0a 0d 0a 7b 22|statusCode|22 3a 20 22|success|22 2c 20 22|cookieKey|22 3a 20 22|"

  • Value: "|22 2c 20 22|cookieDomain|22 3a 20 22|"

  • Value: "|22 2c 20 22|cookieValue|22 3a 20 22|"

Within: 21

PCRE: "/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22\x7d$/R"

Special Options:

source