ET MALWARE Matanbuchus CnC Tunneling Activity, Session Established, * .microsoft \.com variant

7.0.3 5.0SID: 2072517Rev: 1Enabled1 views

Fileemerging-malware.rules

CreatedOctober 19, 2026

UpdatedOctober 20, 2026

Classificationcommand-and-control

alert udp $EXTERNAL_NET 5354 -> $HOME_NET any (msg:"ET MALWARE Matanbuchus CnC Tunneling Activity, Session Established, * .microsoft \.com variant"; reference:url,recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries; reference:url,tria.ge/250716-b5sksa1wgt; classtype:command-and-control; sid:2072517; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_10_19, deployment Perimeter, deployment SSLDecrypt, malware_family Matanbuchus, confidence Medium, signature_severity Major, tag c2, updated_at 2026_10_20, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1572, mitre_technique_name Protocol_Tunneling;)

Detection details are hidden.

References

url	recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries
url	tria.ge/250716-b5sksa1wgt

Metadata

attack targetClient_Endpoint

tls stateTLSDecrypt

created at2026_10_19

deploymentSSLDecrypt

malware familyMatanbuchus

confidenceMedium

signature severityMajor

tagc2

updated at2026_10_20

mitre tactic idTA0011

mitre tactic nameCommand_And_Control

mitre technique idT1572

mitre technique nameProtocol_Tunneling

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!