TGI HUNT PE File b64 and compressed

SID: 2610814Rev: 1Enabled22 views
Filehunting.rules
CreatedMarch 19, 2025
UpdatedMarch 19, 2025
Classificationbad-unknown
alert tcp any any -> any any (msg:"TGI HUNT PE File b64 and compressed"; flow:established,to_client; content:"7b0HYBxJliUmL23Ke39K9UrX"; threshold:type limit, track by_src, seconds 60, count 1; reference:url,github.com/lukebaggett/dnscat2-powershell/blob/master/dnscat2.ps1; classtype:bad-unknown; sid:2610814; rev:1;)

References

urlgithub.com/lukebaggett/dnscat2-powershell/blob/master/dnscat2.ps1

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!