🐾 - 🚨 Suspicious TLS Certificate including .gdn TLD in issuer informations - Possible Dridex 👿 C2 Server - Suricata Rule 3300679 (pawpatrules)

🐾 - 🚨 Suspicious TLS Certificate including .gdn TLD in issuer informations - Possible Dridex 👿 C2 Server

SID: 3300679Rev: 10 views

Sourcepawpatrules

CreatedApril 2, 2022

UpdatedApril 2, 2022

Classificationtrojan-activity

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - 🚨 Suspicious TLS Certificate including .gdn TLD in issuer informations - Possible Dridex 👿 C2 Server"; flow:established,to_client; tls.cert_issuer; content:".gdn"; endswith; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.dridex; metadata:created_at 2022_04_02, updated_at 2022_04_02; sid:3300679; rev:1; classtype:trojan-activity;)

References

url	https://malpedia.caad.fkie.fraunhofer.de/details/win.dridex

🐾 - 🚨 Suspicious TLS Certificate including .gdn TLD in issuer informations - Possible Dridex 👿 C2 Server

References

Metadata

Comments (0)