Skip to content

Instantly share code, notes, and snippets.

@am1ru1

am1ru1/fox-srt-mwi.rules

Forked from fox-srt/fox-srt-mwi.rules
Last active August 29, 2015 14:20
Show Gist options
  • Save am1ru1/1f741d5aa639fd97d421 to your computer and use it in GitHub Desktop.
Save am1ru1/1f741d5aa639fd97d421 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
fox-srt-mwi.rules
# Signatures for detecting Microsoft Word Intruder
# https://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FOX-SRT - Trojan - Microsoft Word Intruder payload request"; content:"GET"; depth:3; flowbits:set,wmi; content:!"Referer|3a| "; content:!"Cookie|3a| "; uricontent:"&act=1"; fast_pattern: only; pcre:"/\/webstat\/image\.php\?id=[0-9]{8}/"; threshold: type limit, track by_src, count 1, seconds 3600; classtype:trojan-activity; reference:url,https://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html; sid:21001609; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"FOX-SRT - Trojan - Microsoft Word Intruder payload response"; flowbits:isset,mwi; content:"Content-Type|3a| application/octet-stream"; content:"Content-Description|3a| File Transfer"; pcre:"/filename=[0-9]{8}\.exe/"; threshold: type limit, track by_src, count 1, seconds 3600; classtype:trojan-activity; reference:url,https://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html; sid:21001610; rev:1;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment