alert ssh $EXTERNAL_NET [53,80,443] -> any any (msg:"🐾 - 🚨 SSH suspicious flow - Possible connection to FIN7 👿 C2"; flow:to_client, stateless; threshold:type limit, track by_src,count 1, seconds 3600; ssh.software; content:"openssh"; nocase; ssh.hassh.server; content:"b12d2871a1189eff20364cf5333619ee"; fast_pattern; reference:url,https://www.prodaft.com/resource/detail/fin7-unveiled-deep-dive-notorious-cybercrime-gang; reference:url,https://www.prodaft.com/m/reports/FIN7_TLPCLEAR.pdf; reference:url,https://www.cert.ssi.gouv.fr/cti/CERTFR-2022-CTI-003/; reference:url,https://malpedia.caad.fkie.fraunhofer.de/actor/fin7; reference:url,https://pawpatrules.fr/references/fin7_ssh_backdoor.html; metadata:created_at 2022_12_28, updated_at 2024_06_27; sid:3300706; rev:6; classtype:trojan-activity;)