ET MALWARE TA399/Sidewinder Activity Payload Request M2, Microsoft Office UA Request for .rtf

SID: 2033858Rev: 41 views
History
Sourceet/open
CreatedSeptember 1, 2021
UpdatedSeptember 26, 2024
Classificationcommand-and-control
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TA399/Sidewinder Activity Payload Request M2, Microsoft Office UA Request for .rtf"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".rtf"; endswith; fast_pattern; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.header_names; content:!"Referer"; reference:url,twitter.com/ShadowChasing1/status/1433038639961804800; reference:md5,c9f8addb927c3b96aee6a9f671a1f801; classtype:command-and-control; sid:2033858; rev:4; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2021_09_01, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag TA399, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_09_26, reviewed_at 2023_08_22;)

References

urltwitter.com/ShadowChasing1/status/1433038639961804800
md5
c9f8addb927c3b96aee6a9f671a1f801
Google SearchBrave Search

Metadata

attack targetClient_Endpoint
tls stateTLSDecrypt
created at2021_09_01
deploymentSSLDecrypt
confidenceHigh
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_09_26
reviewed at2023_08_22

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!