MALWARE [PTsecurity] Observed Malicious SSL Certificate (Orcus RAT)

SID: 11002134Rev: 20 views
Sourceptresearch/attackdetection
CreatedOctober 24, 2017
UpdatedOctober 24, 2017
Classificationtrojan-activity
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE [PTsecurity] Observed Malicious SSL Certificate (Orcus RAT)"; flow:established, to_client; content:"|a003 0201 0202 10|"; depth:600; threshold:type limit, track by_src, count 1, seconds 30; classtype:trojan-activity; flowbits:noalert; flowbits:set, FB369639_; metadata:created_at 2017_10_24; reference:url, github.com/ptresearch/AttackDetection; sid:11002134; rev:2;)

References

urlgithub.com/ptresearch/AttackDetection

Metadata

created at2017_10_24

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!