Rule History

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET RETIRED PoisonIvy.2013Jan04 victim beacon"; flow:established,to_server; dsize:48; content:"|1e de 5c f1 1f f6 94 12 d1 fa f1 42 8c fe 8d f7|"; offset:16; depth:16; reference:md5,62f20326e0f08c0786df6886f0427ea7; classtype:trojan-activity; sid:2016167; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_05, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, confidence Medium, signature_severity Major, tag PoisonIvy, tag c2, updated_at 2024_12_05, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)