ET EXPLOIT Possible DOUBLEPULSAR Beacon Response

Query · suricata

flow:from_server,established;
content:"|00 00 00 23 ff|SMB2|02 00 00 c0 98 07 c0 00 00|"; depth:18;
content:"|00 00 00 08 ff fe 00 08|"; distance:8; within:8; fast_pattern;
pcre:"/^[\x50-\x59]/R";
content:"|00 00 00|"; distance:1; within:3; endswith;
Raw source ET EXPLOIT Possible DOUBLEPULSAR Beacon Response · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert smb $HOME_NET any -> any any (
    msg:"ET EXPLOIT Possible DOUBLEPULSAR Beacon Response";
    flow:from_server,established;
    content:"|00 00 00 23 ff|SMB2|02 00 00 c0 98 07 c0 00 00|"; depth:18;
    content:"|00 00 00 08 ff fe 00 08|"; distance:8; within:8; fast_pattern;
    pcre:"/^[\x50-\x59]/R";
    content:"|00 00 00|"; distance:1; within:3; endswith;
    classtype:trojan-activity;
    sid:2024216; rev:2;
    metadata:attack_target Client_Endpoint, created_at 2017_04_17, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag c2, updated_at 2019_09_28, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.