ET HUNTING ARM Binary Downloaded via WGET Containing Suspicious Netcat Command - Possible IoT Malware - Suricata Rule 2024241 (et/open)

ET HUNTING ARM Binary Downloaded via WGET Containing Suspicious Netcat Command - Possible IoT Malware

7.0.3 5.0SID: 2024241Rev: 4Enabled2 views

Fileemerging-hunting.rules

CreatedApril 25, 2017

UpdatedApril 6, 2024

Classificationtrojan-activity

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING ARM Binary Downloaded via WGET Containing Suspicious Netcat Command - Possible IoT Malware"; flow:established,to_client; flowbits:isset,ET.armwget; file.data; content:"|25|24|25|28nc+"; content:"+-e+|25|2Fbin|25|2Fsh|25|29"; within:50; fast_pattern; reference:url,blog.netlab.360.com/a-new-threat-an-iot-botnet-scanning-internet-on-port-81-en/; classtype:trojan-activity; sid:2024241; rev:4; metadata:attack_target IoT, created_at 2017_04_25, deployment Perimeter, confidence Medium, signature_severity Major, updated_at 2024_04_06;)

References

url	blog.netlab.360.com/a-new-threat-an-iot-botnet-scanning-internet-on-port-81-en/

Metadata

attack targetIoT

created at2017_04_25

deploymentPerimeter

confidenceMedium

signature severityMajor

updated at2024_04_06

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!