ET MALWARE Fortigate TABLEFLIP Backdoor Trigger - Magic Number Sequence - Suricata Rule 2044677 (et/open)

ET MALWARE Fortigate TABLEFLIP Backdoor Trigger - Magic Number Sequence

SID: 2044677Rev: 10 viewsHistory

Sourceet/open

CreatedMarch 17, 2023

UpdatedMarch 17, 2023

Classificationtrojan-activity

alert tcp-pkt $EXTERNAL_NET any -> $HOME_NET 541 (msg:"ET MALWARE Fortigate TABLEFLIP Backdoor Trigger - Magic Number Sequence"; flow:established,to_server; dsize:20; content:"|17 03 01 01 d8 54 2f 31|"; startswith; fast_pattern; reference:url,www.mandiant.com/resources/blog/fortinet-malware-ecosystem; classtype:trojan-activity; sid:2044677; rev:1; metadata:affected_product Fortigate, attack_target Networking_Equipment, created_at 2023_03_17, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_17;)

References

url	www.mandiant.com/resources/blog/fortinet-malware-ecosystem

Metadata

affected productFortigate

attack targetNetworking_Equipment

created at2023_03_17

deploymentPerimeter

performance impactLow

confidenceHigh

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2023_03_17

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!