""ET TROJAN NginxSpy Magic Bytes M1 (Outbound)""

SID: 2044124

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Web_Server, created_at 2023_02_06, deployment Perimeter, confidence High, signature_severity Major, updated_at 2023_02_06

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "|e5 cf ff 02 b1 69 20 69 75 15 99 45 20 2e 0a 10 e3 10 b3 70 8d 6d ab 54 52 79 f0 1b 78 5e d1 46|"

Within:

PCRE:

Special Options:

  • fast_pattern

source