ET JA3 Hash - Possible Rclone Client Response (Mega Storage)
Sourceet/open
CreatedMay 28, 2021
UpdatedMay 28, 2021
Classificationbad-unknown
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 Hash - Possible Rclone Client Response (Mega Storage)"; flowbits:isset,ET.rclone; ja3s.hash; content:"eb1d94daa7e0344597e756a1fb6e7054"; reference:url,twitter.com/NCCGroupInfosec/status/1398137873954652163; classtype:bad-unknown; sid:2033055; rev:1; metadata:created_at 2021_05_28, confidence Low, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_28;)
Metadata
created at2021_05_28
confidenceLow
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2021_05_28
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!