ET INFO Onion/TOR Successful Proxy Request Response (Inbound)
Sourceet/open
CreatedMarch 16, 2021
UpdatedDecember 8, 2022
Classificationbad-unknown
alert tcp $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET INFO Onion/TOR Successful Proxy Request Response (Inbound)"; flow:established,from_server; content:"|05 00 00 01 00 00 00 00 00 00|"; startswith; fast_pattern; flowbits:isset,ET.zhtrap1; reference:url,blog.netlab.360.com/new_threat_zhtrap_botnet_en/; classtype:bad-unknown; sid:2032084; rev:3; metadata:attack_target Client_and_Server, created_at 2021_03_16, deployment Perimeter, performance_impact Significant, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_12_08;)
References
Metadata
attack targetClient_and_Server
created at2021_03_16
deploymentPerimeter
performance impactSignificant
confidenceHigh
signature severityInformational
tagDescription_Generated_By_Proofpoint_Nexus
updated at2022_12_08
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!