ET MALWARE Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (ASCII)

Query · suricata

flow:to_server,established;
content:"SMB"; offset:5; depth:4;
content:"{AA0EED25-4167-4CBB-BDA8-9A0F5FF93EA8}"; distance:0; nocase;
Raw source ET MALWARE Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (ASCII) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp any any -> any [139,445] (
    msg:"ET MALWARE Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (ASCII)";
    flow:to_server,established;
    content:"SMB"; offset:5; depth:4;
    content:"{AA0EED25-4167-4CBB-BDA8-9A0F5FF93EA8}"; distance:0; nocase;
    reference:url,cyberx-labs.com/wp-content/uploads/2015/05/BlackEnergy-CyberX-Report_27_May_2015_FINAL.pdf;
    classtype:trojan-activity;
    sid:2021179; rev:1;
    metadata:created_at 2015_06_04, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.