ComRAT Network Communication

calendar Feb 26, 2024 · attack.defense_evasion attack.command_and_control attack.t1071.001 attack.g0010  ·
Share on: linkedin copy

Detects Turla ComRAT network communication.

Sigma rule (View on GitHub)

 1title: ComRAT Network Communication
 2id: 7857f021-007f-4928-8b2c-7aedbe64bb82
 3status: test
 4description: Detects Turla ComRAT network communication.
 5references:
 6    - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
 7author: Florian Roth (Nextron Systems)
 8date: 2020/05/26
 9modified: 2024/02/26
10tags:
11    - attack.defense_evasion
12    - attack.command_and_control
13    - attack.t1071.001
14    - attack.g0010
15logsource:
16    category: proxy
17detection:
18    selection:
19        c-uri|contains: '/index/index.php\?h='
20    condition: selection
21falsepositives:
22    - Unknown
23level: high

References

  • JPš¢¥Ãè0#tÃ?kSBǃ9‰ºÜL—4yDµ,TlÂéúëvE ¼òøs=VW±j¬Œ"·TYIŒDnî–{ªýÁW5>¼q÷"áÈNıÉÚ“õm�&{?Ž¼3¶×þ¯xKrŒ`FnÑA‚EžiH‡™¼µ¤º±ÛlÅ]6ÛÛgõ¿fÅó&Û˜Íe×ó<Ù¦K&sµ.¦•u¹)¤ëÔª žK^�ëåfqRXÍÆ$ï ¯ÄëK nŒÂŸ...


    Read More

Related rules

to-top