ET CURRENT_EVENTS Possible Crypto Drainer Fetch

Query · suricata

flow:established,to_server;
http.host;
content:"deep-index.moralis.io";
http.header_names;
content:"|0d 0a|Content-Type|0d 0a|accept|0d 0a|x-api-key";
content:!"|0d 0a|Referer|0d 0a|";
http.uri;
content:"/api/v2/"; startswith;
content:"/nft?chain=eth&format=decimal"; distance:0; endswith; fast_pattern;
flowbits:set,ET.crypto_drainer_fetch;

Rule dependencies

Feeds into

  • 1 rule read ET.crypto_drainer_fetch · view all
Raw source ET CURRENT_EVENTS Possible Crypto Drainer Fetch · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET CURRENT_EVENTS Possible Crypto Drainer Fetch";
    flow:established,to_server;
    http.host;
    content:"deep-index.moralis.io";
    http.header_names;
    content:"|0d 0a|Content-Type|0d 0a|accept|0d 0a|x-api-key";
    content:!"|0d 0a|Referer|0d 0a|";
    http.uri;
    content:"/api/v2/"; startswith;
    content:"/nft?chain=eth&format=decimal"; distance:0; endswith; fast_pattern;
    flowbits:set,ET.crypto_drainer_fetch;
    reference:url,blog.confiant.com/how-one-crypto-drainer-template-facilitates-tens-of-millions-of-dollars-in-theft-66f3794aea4b;
    classtype:trojan-activity;
    sid:2037023; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2022_06_16, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_06_16, reviewed_at 2024_12_24;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.