ET MALWARE EARTHWORM SOCKS Proxy Tunnel Response

Query · suricata

flow:established,to_client;
flowbits:isset,ET.earthworm.request.stage1;
flowbits:set,ET.earthworm.request.stage2;
flowbits:noalert;
dsize:6;
content:"|01 05|"; fast_pattern; startswith;

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Feeds into

  • 1 rule read ET.earthworm.request.stage2 · view all
Raw source ET MALWARE EARTHWORM SOCKS Proxy Tunnel Response · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
#alert tcp-pkt any any -> any any (
#    msg:"ET MALWARE EARTHWORM SOCKS Proxy Tunnel Response";
#    flow:established,to_client;
#    flowbits:isset,ET.earthworm.request.stage1;
#    flowbits:set,ET.earthworm.request.stage2;
#    flowbits:noalert;
#    dsize:6;
#    content:"|01 05|"; fast_pattern; startswith;
#    reference:url,community.emergingthreats.net/t/sig-earthworm-reverse-socks-handshake-and-tunnel-sequence-detection/3314;
#    classtype:trojan-activity;
#    sid:2069306; rev:1;
#    metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2026_05_14, deployment Perimeter, deployment Internal, malware_family EarthWorm, performance_impact Significant, confidence High, signature_severity Major, tag SOCKS_Reverse_Proxy, updated_at 2026_05_14, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1090, mitre_technique_name Proxy;
#)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.