""ET TROJAN ThirdEye Stealer CnC Checkin""

SID: 2046696

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2023_06_29, updated_at 2023_06_29

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

• Value: "GET /general/ch3ckState HTTP" Depth: 28

• Value: "Cookie|3a 20|3rd_eye|3d|"

Within:

PCRE: "/^[a-f0-9]{24}\x3b/R"

Special Options:

• fast_pattern

source