Versions (4)
Version DetailsCurrent
Rev: 1 • Aug 24, 2020, 12:00 PMET MALWARE DeathStalker/Powersing CnC Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DeathStalker/Powersing CnC Checkin"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|22|un|22 3a|"; content:"|22|cn|22 3a|"; distance:0; content:"|22|av|22 3a|"; distance:0; content:"|22|dob|22 3a|"; distance:0; fast_pattern; content:"|22|os|22 3a|"; distance:0; content:"|22|ou|22 3a|"; distance:0; content:"|22|dc|22 3a|"; distance:0; reference:url,securelist.com/deathstalker-mercenary-triumvirate/98177/; classtype:command-and-control; sid:2030726; rev:1; metadata:created_at 2020_08_24, deployment Perimeter, malware_family Powersing, confidence High, signature_severity Major, tag APT, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_24;)
Aug 24, 2020, 12:00 PM
Aug 24, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 16, 2025, 8:36 PM
rules/emerging-malware.rules