Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BOUNCEBEAM Backdoor CnC Activity"; flow:established,to_server; http.uri; content:"/api/getTask?uniqid="; startswith; http.host; content:"cloudflare.5156game.com"; fast_pattern; bsize:23; reference:url,twitter.com/ESETresearch/status/1415542465176735748; reference:md5,429914c2cf45355ca4baa95a1dcdffab; reference:md5,19b8681e4dd4f9698ec324606a642dd6; reference:md5,bded44bf177a52a9ffbd13d077f8747d; classtype:command-and-control; sid:2033389; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_07_22, deployment Perimeter, confidence High, signature_severity Major, tag c2, updated_at 2021_07_22, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)