Rule History

SID: 2034213 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 2 • Oct 18, 2021, 12:00 PM

Message:

ET DELETED Possible BlackByte Ransomware Encryption Key Inbound (fake .png)

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible BlackByte Ransomware Encryption Key Inbound (fake .png)"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:!"|89 50 4E 47 0D 0A 1A 0A|"; startswith; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/si"; flowbits:isset,ET.httpget.png; classtype:command-and-control; sid:2034213; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_10_18, deployment Perimeter, malware_family BlackByte, signature_severity Major, tag Ransomware, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_10_19;)

Created:

Oct 18, 2021, 12:00 PM

Updated:

Oct 19, 2021, 12:00 PM

DB Created:

Oct 18, 2021, 12:00 PM

DB Updated:

Sep 8, 2025, 9:34 PM

Filename:

rules/emerging-deleted.rules