ET MALWARE Outbound POST Request with ps PowerShell Command Output
Sourceet/open
CreatedApril 16, 2019
UpdatedSeptember 1, 2020
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Outbound POST Request with ps PowerShell Command Output"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"|48 61 6e 64 6c 65 73 20 20 4e 50 4d 28 4b 29 20 20 20 20 50 4d 28 4b 29 20 20 20 20 20 20 57 53 28 4b 29|"; fast_pattern; reference:url,attack.mitre.org/techniques/T1057/; reference:url,attack.mitre.org/techniques/T1086/; classtype:trojan-activity; sid:2027210; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_04_16, performance_impact Low, confidence High, signature_severity Major, tag T1086, tag T1057, updated_at 2020_09_01;)
Metadata
affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
created at2019_04_16
performance impactLow
confidenceHigh
signature severityMajor
tagT1057
updated at2020_09_01
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!