Snort mailing list archives
New Agenttesla email exfil sig
From: James Lay via Snort-sigs <snort-sigs () lists snort org>
Date: Mon, 18 Nov 2019 14:27:02 -0700
Cause these clowns keep modding this junk:alert tcp any any -> any 25,465,587 (msg:"TROJAN: New AgentTesla Email Exfil"; flow:established,to_server; content:"Subject:"; content:"|2f|"; within:50; content:"|3c|br|3e|User Name:"; content:"|3c|br|3e|OSFullName:"; classtype:trojan-activity; sid:20166308; rev:1; metadata:created_at 2019_11_16;)
James _______________________________________________ Snort-sigs mailing list Snort-sigs () lists snort org https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
Current thread:
- New Agenttesla email exfil sig James Lay via Snort-sigs (Nov 18)