ET MALWARE SYNful Knock Cisco IOS Router Implant CnC Beacon (INBOUND)

SID: 2021785Rev: 30 viewsHistory

Sourceet/open

CreatedSeptember 16, 2015

UpdatedJuly 26, 2019

Classificationcommand-and-control

alert tcp any any -> $HOME_NET 80 (msg:"ET MALWARE SYNful Knock Cisco IOS Router Implant CnC Beacon (INBOUND)"; flow:established,to_server; content:"|00 00 00 00|text|00|"; byte_jump:4,0,relative,post_offset -1; isdataat:!2,relative; reference:url,fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html; classtype:command-and-control; sid:2021785; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_09_16, deployment Perimeter, signature_severity Major, tag c2, updated_at 2019_07_26, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)

References

url	fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html

Metadata

attack targetClient_Endpoint

created at2015_09_16

deploymentPerimeter

signature severityMajor

tagc2

updated at2019_07_26

mitre tactic idTA0010

mitre tactic nameExfiltration

mitre technique idT1041

mitre technique nameExfiltration_Over_C2_Channel

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!