Versions (4)
Version DetailsCurrent
Rev: 3 • Nov 22, 2017, 12:00 PMET DELETED Possible NanoCore C2 64B
alert tcp $HOME_NET 1024:65535 -> $EXTERNAL_NET [!37018,!37039,1024:65535] (msg:"ET DELETED Possible NanoCore C2 64B"; flow:established,to_server; dsize:68; content:"|40 00 00 00|"; depth:5; pcre:"/^(?!.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(?!.{0,62}\x00{2})(?!.{0,59}[A-Za-z0-9]{5})(?!(?P<b1>.).{0,63}(?P=b1).{0,62}(?P=b1).{0,61}(?P=b1).{0,60}(?P=b1))(?!.(?P<b2>.).{0,62}(?P=b2).{0,61}(?P=b2).{0,60}(?P=b2).{0,59}(?P=b2))(?!..(?P<b3>.).{0,61}(?P=b3).{0,60}(?P=b3).{0,59}(?P=b3).{0,58}(?P=b3))(?!...(?P<b4>.).{0,60}(?P=b4).{0,59}(?P=b4).{0,58}(?P=b4).{0,57}(?P=b4))(?!....(?P<b5>.).{0,59}(?P=b5).{0,58}(?P=b5).{0,57}(?P=b5).{0,56}(?P=b5))(?!.....(?P<b6>.).{0,58}(?P=b6).{0,57}(?P=b6).{0,56}(?P=b6).{0,55}(?P=b6))(?!......(?P<b7>.).{0,57}(?P=b7).{0,56}(?P=b7).{0,55}(?P=b7).{0,54}(?P=b7))(?!.......(?P<b8>.).{0,56}(?P=b8).{0,55}(?P=b8).{0,54}(?P=b8).{0,53}(?P=b8))(?!........(?P<b9>.).{0,55}(?P=b9).{0,54}(?P=b9).{0,53}(?P=b9).{0,52}(?P=b9))(?!.........(?P<b10>.).{0,54}(?P=b10).{0,53}(?P=b10).{0,52}(?P=b10).{0,51}(?P=b10))/Rs"; classtype:command-and-control; sid:2025018; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_11_22, deployment Perimeter, malware_family NanoCore, signature_severity Unknown, tag Nanocore, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_10_04;)
Nov 22, 2017, 12:00 PM
Oct 4, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 29, 2025, 9:34 PM
rules/emerging-deleted.rules