Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PyRation Variant - Configuration Request"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:14; content:"/client/config"; fast_pattern; http.user_agent; content:"python-requests/"; startswith; http.header_names; content:"|0d 0a|identity|0d 0a|"; reference:url,www.stratosphereips.org/blog/2024/2/23/analysis-and-understanding-of-malware-of-the-pyration-family; reference:url,github.com/stratosphereips/Malware-CC-Recovery/blob/main/README.md; reference:md5,45038b5cb3575f4cc43abe758544bf23; classtype:command-and-control; sid:2051082; rev:1; metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2024_02_26, deployment Perimeter, malware_family PyRation, performance_impact Low, confidence High, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_26; target:src_ip;)