SPYWARE [PTsecurity] Buhtrap FB set SMB.TreeConnect.ADMIN
Sourceptrules/open
CreatedOctober 9, 2025
UpdatedOctober 9, 2025
Classificationtrojan-activity
alert smb $HOME_NET any -> $HOME_NET 445 (msg:"SPYWARE [PTsecurity] Buhtrap FB set SMB.TreeConnect.ADMIN"; flow:established, to_server, no_stream; content:"SMB"; content:"|03 00|"; distance:8; within:2; content:"|5c 00 41 00 44 00 4d 00 49 00 4e 00 24 00|"; distance:48; isdataat:!1, relative; flowbits:noalert; flowbits:set, SMB.TreeConnect.ADMIN; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10003306; rev:4;)
References
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!