ET MALWARE TA577 Style Response (2023-05-15)

flow:established,to_client;
flowbits:isset,ET.TA557.20230515.Request;
http.stat_code;
content:"200";
http.header;
content:"content-description"; nocase;
content:"|3a 20|File Transfer|0d 0a|"; within:17; fast_pattern;
content:"content-disposition|3a 20|"; nocase;
content:"attachment|3b 20|filename|3d|"; within:21;
content:"cache-control|3a 20|"; nocase;
content:"must|2d|revalidate|2c 20|post|2d|check|3d|0|2c 20|pre|2d|check|3d|0"; within:42;
content:"content-transfer-encoding|3a 20|"; nocase;
content:"binary|0d 0a|"; within:8;
content:"expires|3a 20|0|0d 0a|"; nocase;
http.content_type; bsize:24;
content:"application/octet-stream";
target:dest_ip;

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

• correlates · Suricata flowbits ET.TA557.20230515.Request
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)
  • ET MALWARE TA577 Style Request (2023-05-15)