ET MALWARE Ebury SSH Rootkit data exfiltration
Sourceet/open
CreatedFebruary 21, 2014
UpdatedJuly 15, 2022
Classificationtrojan-activity
alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ebury SSH Rootkit data exfiltration"; content:"|12 0b 01 00 00 01|"; depth:6; pcre:"/^\x12\x0b\x01\x00\x00\x01[\x00]{6}.[a-f0-9]{6,}(([\x01|\x02|\x03]\d{1,3}){4}|\x03::1)\x00\x00\x01/Bs"; reference:url,cert-bund.de/ebury-faq; classtype:trojan-activity; sid:2018164; rev:2; metadata:created_at 2014_02_21, confidence Medium, signature_severity Major, updated_at 2022_07_15;)
References
Metadata
created at2014_02_21
confidenceMedium
signature severityMajor
updated at2022_07_15
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!