ET HUNTING Powershell Script Inbound Which Downloads C++ Compiler (Used by Stagers)
Sourceet/open
CreatedApril 17, 2025
UpdatedApril 17, 2025
Classificationmisc-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Powershell Script Inbound Which Downloads C++ Compiler (Used by Stagers)"; flow:established,to_client; http.response_body; bsize:<200; content:"iwr|20|https|3a 2f 2f|download|2e|microsoft|2e|com|2f|download|2f|"; startswith; content:"|2d|out|20 22 24|env|3a|TMP|2f|vc|5f|redist|2e|x64|2e|exe|22 3b 20 26 20 22 24|env|3a|TMP|2f|vc|5f|redist|2e|x64|2e|exe|22|"; endswith; fast_pattern; classtype:misc-activity; sid:2061723; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state plaintext, created_at 2025_04_17, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2025_04_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer; target:dest_ip;)
Metadata
affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
attack targetClient_Endpoint
tls stateplaintext
created at2025_04_17
deploymentPerimeter
confidenceHigh
signature severityInformational
updated at2025_04_17
mitre tactic idTA0011
mitre tactic nameCommand_And_Control
mitre technique idT1105
mitre technique nameIngress_Tool_Transfer
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!