""ET TROJAN TA444 Related JS Activity Sending Windows System Process Information (POST)""

SID: 2049281

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2023_11_22, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2023_11_22

Reference:

  • md5

  • 31af7ca58c844bdc40d367ff91ee55f7

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: !"|2e|"

  • Value: "|7b 22 75 69 64 22 3a 22|" Depth: 8

  • Value: "|22 2c 20 22 6d 69 64 22 3a 22|"

  • Value: "|22 2c 20 22 64 61 74 61 22 3a 22 7c|"

  • Value: "|7c 53 79 73 74 65 6d 7c|"

  • Value: !"Referer"

Within: 36

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_client_body

  • fast_pattern

  • http_client_body

  • http_client_body

  • http_client_body

  • http_header

source