Versions (2)
Version DetailsCurrent
Rev: 2 • Jul 30, 2024, 12:00 PM🐾 - 🚨 Suspicious Certutil connection to Internet 🌐 - T1105
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Suspicious Certutil connection to Internet 🌐 - T1105"; flow:to_server, stateless; http.user_agent; content:"CertUtil URL Agent"; nocase; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Certutil/#download; target:src_ip; metadata:signature_severity Major, attack_target Client_and_Server, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer, created_at 2024_07_30, updated_at 2024_08_01; sid:3321313; rev:2; classtype:command-and-control;)
Jul 30, 2024, 12:00 PM
Aug 1, 2024, 12:00 PM
Aug 1, 2024, 12:02 PM
May 29, 2025, 11:12 PM
rules/PAW-PATRULES_MALWARES.rules