🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1.3 Windows 11 🪟) - Suricata Rule 3301087 (pawpatrules)

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1.3 Windows 11 🪟)

SID: 3301087Rev: 1Enabled9 views

FilePAW-PATRULES_VULN.rules

CreatedNovember 5, 2023

UpdatedNovember 5, 2023

Classificationpolicy-violation

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1.3 Windows 11 🪟)"; flow:to_server, stateless; ja3.hash; content:"3c4eb72b882d4d1442c67ce73f1292a9"; fast_pattern; tls_sni; content:"massgrave.dev"; nocase; reference:url,https://massgrave.dev/; reference:url,https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/; metadata:created_at 2023_11_05, updated_at 2023_11_05; sid:3301087; rev:1; classtype:policy-violation;)

References

url	https://massgrave.dev/
url	https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/

🐾 - 🚨 Unofficial Microsoft Activation Scripts (MAS) for Windows 🪟 and Office 📘 Invoke-RestMethod execution (TLSv1.3 Windows 11 🪟)

References

Metadata

Comments (0)