🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1) - Suricata Rule 3321461 (pawpatrules)

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)

SID: 3321461Rev: 1273 views

Sourcepawpatrules

CreatedSeptember 30, 2025

UpdatedSeptember 30, 2025

Classificationpolicy-violation

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)"; flow:to_server, stateless; ja3.hash; content:"54328bd36c14bd82ddaa0c04b25ed9ad"; fast_pattern; tls_sni; content:"get.activated.win"; nocase; reference:url,https://massgrave.dev/; reference:url,https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/; metadata:created_at 2025_09_30, updated_at 2025_09_30; sid:3321461; rev:1; classtype:policy-violation;)

References

url	https://massgrave.dev/
url	https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)

References

Metadata

Comments (0)