""ET TROJAN Observed Malicious SSL Cert (Silver Keylogger)""

SID: 2049629

Revision: 2

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2023_12_08, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2024_01_08, reviewed_at 2024_05_07

Reference:

  • md5

  • d6527f7d5f5152c3f5fff6786e5c1606

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: [6666,9999]

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "|16|"

  • Value: "|0b|"

  • Value: "|06 03 55 04 03|"

  • Value: "|06|Silver"

Within: 7

PCRE:

Special Options:

  • fast_pattern

source