ET MALWARE Reptile Linux LKM Rootkit Backdoor Activity

Query · suricata

flow:not_established;
dsize:<40;
content:"hax0r"; fast_pattern;
target:dest_ip;
Raw source ET MALWARE Reptile Linux LKM Rootkit Backdoor Activity · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp any 666 -> any 4444 (
    msg:"ET MALWARE Reptile Linux LKM Rootkit Backdoor Activity";
    flow:not_established;
    dsize:<40;
    content:"hax0r"; fast_pattern;
    reference:url,github.com/f0rb1dd3n/Reptile;
    classtype:trojan-activity;
    sid:2048042; rev:1;
    metadata:attack_target Linux_Unix, created_at 2023_09_12, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_09_12, reviewed_at 2023_09_12;
    target:dest_ip;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.