2 lines
378 B
Plaintext
2 lines
378 B
Plaintext
|
alert tcp $HOME_NET any -> $EXTERNAL_NET 10011 (msg:"MOONSHINE payload C2 activity"; flow:established,to_server; content:"GET"; content:"/ws?whisky_id|3d|"; content:"User-Agent: hots scot"; content:"Upgrade: websocket"; reference:url,https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits; classtype:trojan-activity; sid:3000003; rev:1;)
|