Rule History

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Suspicious TLSV1.2 connection from 🪟 Windows (MSHTA) Microsoft HTML Application (check that the destination is legitimate) Webdav or Certutil - T1218.005 - T1105"; flow:to_server, stateless; ja3.hash; content:"a0e9f5d64349fb13191bc781f81f42e1"; fast_pattern; tls_sni; content:!"office.com"; endswith; nocase; content:!"msn.com"; endswith; nocase; content:!"live.com"; endswith; nocase; content:!"office.net"; endswith; nocase; content:!"microsoft.com"; endswith; nocase; content:!"outlook.com"; endswith; nocase; content:!"mozilla.org"; endswith; nocase; content:!"msedge.net"; endswith; nocase; content:!"office365.com"; endswith; nocase; content:!"sharepoint.com"; endswith; nocase; content:!".ms"; endswith; nocase; content:!"onenote.net"; endswith; nocase; content:!"adobe.io"; endswith; nocase; content:!"gimp.org"; endswith; nocase; content:!"windows.com"; endswith; nocase; content:!"akamaized.net"; endswith; nocase; content:!".microsoft"; endswith; nocase; content:!".windows.net"; endswith; nocase; content:!".bing.com"; endswith; nocase; content:!".typekit.com"; endswith; nocase; content:!".skype.com"; endswith; nocase; content:!".adobesc.com"; endswith; nocase; content:!".adobess.com"; endswith; nocase; content:!".google-analytics.com"; endswith; nocase; content:!".aadrm.com"; endswith; nocase; content:!".google.com"; endswith; nocase; content:!".aprimocdn.net"; endswith; nocase; content:!".microsoftusercontent.com"; endswith; nocase; content:!".hpconnected.com"; endswith; nocase; reference:url,https://attack.mitre.org/techniques/T1218/005/; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Mshta/#download; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Certutil/#download; target:src_ip; metadata:created_at 2024_06_26, updated_at 2025_08_27, signature_severity Major, attack_target Client_and_Server, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1218_005, mitre_technique_name System_Binary_Proxy_Execution_Mshta, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer; sid:3321287; rev:21; classtype:trojan-activity;)