""ET TROJAN Possible Lockbit CnC Checkin""

SID: 2045316

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2023_05_04, deployment Perimeter, malware_family LockBit, performance_impact Significant, signature_severity Major, tag Ransomware, updated_at 2023_05_04, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact

Reference:

Protocol: tcp

Source Network: [$HOME_NET,$HTTP_SERVERS]

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "."

  • Value: "/?"

  • Value: "&"

  • Value: "="

  • Value: "&="

  • Value: "="

  • Value: "Accept-Encoding|3a 20|gzip,|20|deflate,|20|br"

  • Value: "Content-Type|3a 20|text/plain"

Within: 8

PCRE: "/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/"

Special Options:

  • http_method

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_client_body

  • http_client_body

  • http_header

  • http_header

  • base64_data

source