🐾 - ⚠ Suspicious TLSv1 connection from 🪟 Windows 10 socket to public IP address - Possible ☠ Meterpreter / Cobalt Strike / other C2 - Suricata Rule 3300713 (pawpatrules)

🐾 - ⚠ Suspicious TLSv1 connection from 🪟 Windows 10 socket to public IP address - Possible ☠ Meterpreter / Cobalt Strike / other C2

SID: 3300713Rev: 20 views

Sourcepawpatrules

CreatedNovember 24, 2022

UpdatedMarch 17, 2023

Classificationtrojan-activity

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ⚠ Suspicious TLSv1 connection from 🪟 Windows 10 socket to public IP address - Possible ☠ Meterpreter / Cobalt Strike / other C2"; flow:to_server, stateless; ja3.hash; content:"49ed2ef3f1321e5f044f1e71b0e6fdd5"; metadata:former_category JA3; reference:url,https://sslbl.abuse.ch/ja3-fingerprints/49ed2ef3f1321e5f044f1e71b0e6fdd5/; metadata:created_at 2022_11_24, updated_at 2023_03_17; sid:3300713; rev:2; classtype:trojan-activity;)

References

url	https://sslbl.abuse.ch/ja3-fingerprints/49ed2ef3f1321e5f044f1e71b0e6fdd5/

🐾 - ⚠ Suspicious TLSv1 connection from 🪟 Windows 10 socket to public IP address - Possible ☠ Meterpreter / Cobalt Strike / other C2

References

Metadata

Comments (0)