rule: implant teardown

2019-08-30 11:48:51 +02:00
parent 8a078b6c86
commit a3349823e5
1 changed files with 20 additions and 0 deletions
@@ -0,0 +1,20 @@
+title: Teardown Implant URL Pattern
+status: experimental
+description: Detects URL pattern used by Teardown Implant
+references:
+    - https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html
+author: Florian Roth
+date: 2019/08/30
+logsource:
+    category: proxy
+detection:
+    selection:
+        c-uri-query: '*/list/suc?name=*'
+    condition: selection
+fields:
+    - ClientIP
+    - URL
+    - UserAgent
+falsepositives:
+    - Unknown
+level: critical