ET HUNTING Download file with BITS via LNK file (Likely Malicious)

7.0.35.0SID: 2021092Rev: 3Enabled1 views
Sourceet/open
Fileemerging-hunting.rules
CreatedMay 13, 2015
UpdatedMarch 14, 2024
Classificationtrojan-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Download file with BITS via LNK file (Likely Malicious)"; flow:established,to_client; file.data; content:"|4c 00 00 00|"; within:4; content:"|00|b|00|i|00|t|00|s|00|a|00|d|00|m|00|i|00|n|00|"; nocase; content:"|00|t|00|r|00|a|00|n|00|s|00|f|00|e|00|r|00|"; nocase; classtype:trojan-activity; sid:2021092; rev:3; metadata:created_at 2015_05_13, confidence Medium, signature_severity Major, updated_at 2024_03_14;)

Metadata

created at2015_05_13
confidenceMedium
signature severityMajor
updated at2024_03_14

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!