Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Limbozar Ransomware Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/postme"; bsize:7; http.header; content:"|0d 0a|from|3a 20|me|0d 0a|"; fast_pattern; content:"|0d 0a|user-agent|3a 20|libsfml-network/"; http.request_body; content:"&ip="; startswith; content:"&disk="; distance:0; content:"&id="; distance:0; content:"&mail="; distance:0; http.header_names; content:!"Referer"; reference:url,securelist.com/cis-ransomware/104452/; reference:md5,91332f289d3e577b57d878b55c5cf18a; classtype:trojan-activity; sid:2034195; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_10_15, deployment Perimeter, malware_family Win32_Limbozar, confidence High, signature_severity Major, tag Ransomware, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_10_15, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)