🐾 - 🚨 Possible Windows 11 Installer / Bitsadmin or Desktopimgdownldr TLSv1.3 connection to IP address - T1105

SID: 3321317Rev: 261 views
History
Sourcepawpatrules
CreatedAugust 1, 2024
UpdatedMarch 6, 2025
Classificationpolicy-violation
alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Possible Windows 11 Installer / Bitsadmin or Desktopimgdownldr TLSv1.3 connection to IP address - T1105"; flow:to_server, stateless; ja3.hash; content:"46dfa2c5af26d0476eff93b4db742d77"; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/#download; reference:url,https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/#download; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Desktopimgdownldr/#download; reference:url,https://www.senseon.io/resource/resurgent-usb-malware-battling-raspberry-robin/; target:src_ip; metadata:attack_target Client_and_Server, signature_severity Major, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer, created_at 2024_08_01, updated_at 2025_03_06; sid:3321317; rev:2; classtype:policy-violation;)

References

urlhttps://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/#download
urlhttps://lolbas-project.github.io/lolbas/Binaries/AppInstaller/#download
urlhttps://lolbas-project.github.io/lolbas/Binaries/Desktopimgdownldr/#download
urlhttps://www.senseon.io/resource/resurgent-usb-malware-battling-raspberry-robin/

Metadata

attack targetClient_and_Server
signature severityMajor
affected productWindows_XP_Vista_7_8_10_11_Server_32_64_Bit
mitre tactic idTA0011
mitre tactic nameCommand_and_Control
mitre technique idT1105
mitre technique nameIngress_Tool_Transfer
created at2024_08_01
updated at2025_03_06

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!