🐾 - 💀 Malicious HTTP 🪟 Windows connection to 🦹 Hoaxshell C2 with custom http.header
Sourcepawpatrules
CreatedDecember 4, 2022
UpdatedDecember 4, 2022
Classificationtrojan-activity
alert http $HOME_NET any -> any any (msg:"🐾 - 💀 Malicious HTTP 🪟 Windows connection to 🦹 Hoaxshell C2 with custom http.header"; flow:to_server, stateless; threshold:type threshold, track by_src, count 5, seconds 10; http.header.raw; content:!"X-"; content:!"Authorization: "; content:"|3a 20|"; pcre:"/[a-z0-9]{8}-[a-z0-9]{8}-[a-z0-9]{8}/"; http.user_agent; content:"WindowsPowerShell/"; fast_pattern; nocase; http.method; content:"GET"; http.uri; content:"/"; startswith; pcre:"/[a-z0-9]{8}/"; reference:url,https://github.com/t3l3machus/hoaxshell; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_12_04, updated_at 2022_12_04; sid:3300697; rev:3; classtype:trojan-activity;)
References
Metadata
affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
attack targetClient_Endpoint
created at2022_12_04
updated at2022_12_04
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!