🐾 - 💀 Malicious HTTP 🪟 Windows connection to 🦹 Villain C2 or Hoaxshell with -Authorization- http.header
Sourcepawpatrules
CreatedDecember 2, 2022
UpdatedDecember 4, 2022
Classificationtrojan-activity
alert http $HOME_NET any -> any any (msg:"🐾 - 💀 Malicious HTTP 🪟 Windows connection to 🦹 Villain C2 or Hoaxshell with -Authorization- http.header"; flow:to_server, stateless; threshold:type threshold, track by_src, count 5, seconds 10; http.header.raw; content:"Authorization: "; pcre:"/Authorization: [a-z0-9]{8}-[a-z0-9]{8}-[a-z0-9]{8}/"; http.user_agent; content:"WindowsPowerShell/"; fast_pattern; nocase; http.method; content:"GET"; http.uri; content:"/"; startswith; pcre:"/[a-z0-9]{8}/"; http.protocol; content:"HTTP/1.1"; reference:url,https://github.com/t3l3machus/hoaxshell; reference:url,https://github.com/t3l3machus/Villain; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_12_02, updated_at 2022_12_04; sid:3300695; rev:20; classtype:trojan-activity;)
Metadata
affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
attack targetClient_Endpoint
created at2022_12_02
updated at2022_12_04
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!