🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1) - Suricata Rule 3300223 (pawpatrules)

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)

SID: 3300223Rev: 1Enabled1 views

FilePAW-PATRULES_VULN.rules

CreatedMarch 16, 2023

UpdatedMarch 16, 2023

Classificationpolicy-violation

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)"; flow:to_server, stateless; ja3.hash; content:"15b2baf954ea2db42018ede3f07add85"; fast_pattern; tls_sni; content:"massgrave.dev"; nocase; reference:url,https://massgrave.dev/; reference:url,https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/; metadata:created_at 2023_03_16, updated_at 2023_03_16; sid:3300223; rev:1; classtype:policy-violation;)

References

url	https://massgrave.dev/
url	https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1)

References

Metadata

Comments (0)