""ET TROJAN Win32/CosmicRust TA444 CnC Activity (GET)""

SID: 2047748

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_08_24, deployment Perimeter, confidence Medium, signature_severity Critical, tag TA444, updated_at 2023_08_24, reviewed_at 2023_08_24, former_sid 2855179

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "/client"

  • Value: "Connection|3a 20|Upgrade|0d 0a|Upgrade|3a 20|websocket|0d 0a|Sec|2d|WebSocket|2d|Version|3a 20|13|0d 0a|Sec|2d|WebSocket|2d|Key|3a|"

  • Value: "Sec|2d|WebSocket|2d|Protocol|3a 20|rust|2d|websocket|2c 20|ping|0d 0a|Host|3a 20|"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_header

  • http_header

source