🐾 - 🔥👁 FireEye - Backdoor.HTTP.BEACON.[CSBundle Original Stager]

SID: 3309549Rev: 10 views
Sourcepawpatrules
CreatedDecember 11, 2020
UpdatedDecember 11, 2020
Classificationtrojan-activity
alert tcp any any -> any $HTTP_PORTS (msg:"🐾 - 🔥👁 FireEye - Backdoor.HTTP.BEACON.[CSBundle Original Stager]"; content:"T "; offset:2; depth:3; content:"Accept: */*"; content:"Accept-Language: en-US"; content:"Accept-Encoding: gzip, deflate"; content:"Cookie: SIDCC=AN0-TYutOSq-fxZK6e4kagm70VyKACiG1susXcYRuxK08Y-rHysliq0LWklTqjtulAhQOPH8uA"; pcre:"/\/api\/v1\/user\/(?:512|124)\/avatar/"; reference:url,https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html; reference:url,https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html; reference:url,https://github.com/fireeye/red_team_tool_countermeasures; metadata:created_at 2020_12_11, updated_at 2020_12_11; sid:3309549; rev:1; classtype:trojan-activity;)

References

urlhttps://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html
urlhttps://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
urlhttps://github.com/fireeye/red_team_tool_countermeasures

Metadata

created at2020_12_11
updated at2020_12_11

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!