Rule History

SID: 2032974 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 2 • May 18, 2021, 12:00 PM

Message:

ET DELETED Possible Cobalt Strike Server Response

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Cobalt Strike Server Response"; flow:established,to_client; http.stat_code; content:"200"; http.server; content:"ESF"; bsize:3; fast_pattern; http.content_len; byte_test:0,=,0,0,string,dec; reference:md5,5b5a730628dc9eba2c12530d225c2f70; classtype:command-and-control; sid:2032974; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_05_18, deployment Perimeter, deprecation_reason False_Positive, malware_family Cobalt_Strike, performance_impact Low, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_20;)

Created:

May 18, 2021, 12:00 PM

Updated:

May 20, 2021, 12:00 PM

DB Created:

May 18, 2021, 12:00 PM

DB Updated:

Sep 11, 2025, 9:34 PM

Filename:

rules/emerging-deleted.rules