🐾 - 🚨 Suspicious TLSV1.2 connection from 🪟 Windows (possible Webdav malware download) to trycloudflare.com - T1218.005 - T1105 - Suricata Rule 3321459 (pawpatrules)

🐾 - 🚨 Suspicious TLSV1.2 connection from 🪟 Windows (possible Webdav malware download) to trycloudflare.com - T1218.005 - T1105

SID: 3321459Rev: 118 views

Sourcepawpatrules

CreatedAugust 27, 2025

UpdatedAugust 27, 2025

Classificationtrojan-activity

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Suspicious TLSV1.2 connection from 🪟 Windows (possible Webdav malware download) to trycloudflare.com - T1218.005 - T1105"; flow:to_server, stateless; ja3.hash; content:"a0e9f5d64349fb13191bc781f81f42e1"; fast_pattern; tls_sni; content:"trycloudflare.com"; endswith; nocase; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Certutil/#download; target:src_ip; metadata:created_at 2025_08_27, updated_at 2025_08_27, signature_severity Major, attack_target Client_and_Server, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1218_005, mitre_technique_name System_Binary_Proxy_Execution_Mshta, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer; sid:3321459; rev:1; classtype:trojan-activity;)

References

url	https://lolbas-project.github.io/lolbas/Binaries/Certutil/#download

Metadata

created at2025_08_27

updated at2025_08_27

signature severityMajor

attack targetClient_and_Server

affected productWindows_XP_Vista_7_8_10_11_Server_32_64_Bit

mitre tactic idTA0011

mitre tactic nameCommand_and_Control

mitre technique idT1105

mitre technique nameIngress_Tool_Transfer

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!