🐾 - 🚨 Suspicious 👀 non SSL/TLS trafic to an IP address seen in 🔒 Conti Ransomware Leak - Suricata Rule 3317115 (pawpatrules)

🐾 - 🚨 Suspicious 👀 non SSL/TLS trafic to an IP address seen in 🔒 Conti Ransomware Leak

SID: 3317115Rev: 10 views

Sourcepawpatrules

CreatedMarch 4, 2022

UpdatedMarch 4, 2022

Classificationtrojan-activity

alert tcp any any -> [1.2.3.4,5.6.7.8,51.62.71.83,2.3.4.5,21.31.41.51] 443 (msg:"🐾 - 🚨 Suspicious 👀 non SSL/TLS trafic to an IP address seen in 🔒 Conti Ransomware Leak"; flow:to_server; app-layer-protocol:!tls; reference:url,https://github.com/TheParmak/conti-leaks-englished/blob/master/docs/translated/bot/cs2%20proto%20en-US.rtf; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.conti; reference:url,https://malpedia.caad.fkie.fraunhofer.de/actor/unc1878; metadata:created_at 2022_03_04, updated_at 2022_03_04; sid:3317115; rev:1; classtype:trojan-activity;)

References

url	https://github.com/TheParmak/conti-leaks-englished/blob/master/docs/translated/bot/cs2%20proto%20en-US.rtf
url	https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
url	https://malpedia.caad.fkie.fraunhofer.de/actor/unc1878

🐾 - 🚨 Suspicious 👀 non SSL/TLS trafic to an IP address seen in 🔒 Conti Ransomware Leak

References

Metadata

Comments (0)