TGI HUNT Possible Cobalt Strike Extra Whitespace HTTP Response

SID: 2610524Rev: 316 views
History
Sourcetgreen/hunting
CreatedMarch 19, 2025
UpdatedMarch 19, 2025
Classificationtrojan-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"TGI HUNT Possible Cobalt Strike Extra Whitespace HTTP Response"; flow:established,to_client; content:"HTTP/1.1|20|200|20|OK|20 0d 0a|Content-Type|3a|"; flowbits:isnotset,hunt.entrust_entelligence; content:!"WEBrick"; http_header; reference:url,github.com/fox-it/cobaltstrike-extraneous-space; threshold:type limit, track by_src, seconds 60, count 1; classtype:trojan-activity; sid:2610524; rev:3;)

References

urlgithub.com/fox-it/cobaltstrike-extraneous-space

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!