Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Outbound POST Request with ps PowerShell Command Output"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|48 61 6e 64 6c 65 73 20 20 4e 50 4d 28 4b 29 20 20 20 20 50 4d 28 4b 29 20 20 20 20 20 20 57 53 28 4b 29|"; fast_pattern; reference:url,attack.mitre.org/techniques/T1057/; reference:url,attack.mitre.org/techniques/T1086/; classtype:trojan-activity; sid:2027210; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_04_16, performance_impact Low, confidence High, signature_severity Major, tag T1086, tag T1057, updated_at 2020_09_01;)