Rule History

SID: 2038798 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 1 • Sep 12, 2022, 12:00 PM

Message:

ET MALWARE Sidecopy APT Related Backdoor Activity

Rule:

alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Sidecopy APT Related Backdoor Activity"; flow:established,to_server; content:"|3c 7c|MAINSOCKET|7c 3e|"; startswith; fast_pattern; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/R"; content:!"Host|3a 20|"; reference:url,twitter.com/bofheaded/status/1569261149845344261; reference:md5,e3cf9f7ccc2850ac5130cc73ca7762aa; classtype:trojan-activity; sid:2038798; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_09_12, deployment Perimeter, malware_family SideCopy, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_09_12;)

Created:

Sep 12, 2022, 12:00 PM

Updated:

Sep 12, 2022, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Sep 1, 2025, 8:35 PM

Filename:

rules/emerging-malware.rules