Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE PJobRat System Exfil to CnC"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:"|7b 22|network|22 3a 22|"; content:"|22 2c 22|type|22 3a 22 5b|"; content:"|22 2c 22|info|22 3a 22|"; content:"|22 2c 22|ipaddr|22 3a 22|"; content:"|22 2c 22|bandwidth|22 3a 22|"; content:"|22 2c 22|downspeed|22 3a 22|"; content:"|22 2c 22|upspeed|22 3a 22|"; content:"|22 2c 22|rip|22 3a 22|"; content:"|22 2c 22|manufacture|22 3a 22|"; content:"|22 2c 22|imei|22 3a 22|"; content:"|22 2c 22|pnumber|22 3a 22|"; content:"|22 2c 22|location|22 3a 22 5b 7b 5c 22|latitude|5c 22 3a 5c 22|"; fast_pattern; content:"|22 2c 22|appname|22 3a 22|"; reference:url,labs.k7computing.com/?p=22537; classtype:command-and-control; sid:2033319; rev:1; metadata:affected_product Android, created_at 2021_07_13, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_13;)