🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1) - Suricata Rule 3300225 (pawpatrules)

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)

SID: 3300225Rev: 10 views

Sourcepawpatrules

CreatedMarch 16, 2023

UpdatedMay 9, 2023

Classificationpolicy-violation

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)"; flow:to_server, stateless; ja3.hash; content:"235a856727c14dba889ddee0a38dd2f2"; fast_pattern; tls_sni; content:"massgrave.dev"; nocase; reference:url,https://massgrave.dev/; reference:url,https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/; metadata:created_at 2023_03_16, updated_at 2023_05_09; sid:3300225; rev:1; classtype:policy-violation;)

References

url	https://massgrave.dev/
url	https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)

References

Metadata

Comments (0)