13 lines
365 B
Text
13 lines
365 B
Text
rule Careto_CnC {
|
|
meta:
|
|
author = "AlienVault (Alberto Ortega)"
|
|
description = "TheMask / Careto CnC communication signature"
|
|
reference = "www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf"
|
|
strings:
|
|
$1 = "cgi-bin/commcgi.cgi" ascii wide
|
|
$2 = "Group" ascii wide
|
|
$3 = "Install" ascii wide
|
|
$4 = "Bn" ascii wide
|
|
condition:
|
|
all of them
|
|
}
|