Rule History

alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HailBot Server Response"; flow:established,to_server; content:"|57 48 4f 20 54 48 45 20 48 45 4c 4c 20 41 52 45 20 59 4f 55 3f 20 54 45 4c 4c 20 4d 45 20 59 4f 55 52 20 4e 41 4d 45 21 20|"; reference:url,nsfocusglobal.com/mirai-botnets-new-wave-hailbot-kiraibot-catddos-and-their-fierce-onslaught/; classtype:trojan-activity; sid:2050065; rev:1; metadata:attack_target Networking_Equipment, created_at 2024_01_12, deployment Perimeter, malware_family Mirai, malware_family hailBot, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_12;)