ET INFO Onion/TOR Successful Proxy Request Response (Inbound)

7.0.35.0SID: 2032084Rev: 5Enabled1 views
Sourceet/open
Fileemerging-info.rules
CreatedMarch 16, 2021
UpdatedMarch 14, 2024
Classificationbad-unknown
alert tcp $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET INFO Onion/TOR Successful Proxy Request Response (Inbound)"; flow:established,to_client; flowbits:isset,ET.zhtrap1; content:"|05 00 00 01 00 00 00 00 00 00|"; startswith; fast_pattern; reference:url,blog.netlab.360.com/new_threat_zhtrap_botnet_en/; classtype:bad-unknown; sid:2032084; rev:5; metadata:attack_target Client_and_Server, created_at 2021_03_16, deployment Perimeter, performance_impact Significant, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)

References

urlblog.netlab.360.com/new_threat_zhtrap_botnet_en/

Metadata

attack targetClient_and_Server
created at2021_03_16
deploymentPerimeter
performance impactSignificant
confidenceHigh
signature severityInformational
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_03_14

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!