ET ADWARE_PUP Observed OSX/PremierOpinionD Collection Domain in TLS SNI
Sourceet/open
CreatedJuly 9, 2019
UpdatedSeptember 17, 2020
Classificationpup-activity
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Observed OSX/PremierOpinionD Collection Domain in TLS SNI"; flow:established,to_server; threshold:type limit, track by_src, count 1, seconds 600; tls.sni; content:"oss-content.securestudies.com"; endswith; reference:url,www.airoav.com/mitm-voicefive; classtype:pup-activity; sid:2027694; rev:5; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2019_07_09, deployment Perimeter, malware_family PremierOpinionD, performance_impact Low, confidence High, signature_severity Minor, updated_at 2020_09_17;)
References
Metadata
affected productMac_OSX
attack targetClient_Endpoint
created at2019_07_09
deploymentPerimeter
malware familyPremierOpinionD
performance impactLow
confidenceHigh
signature severityMinor
updated at2020_09_17
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!