Skip to content

Instantly share code, notes, and snippets.

@malwareforme

malwareforme/gist:3f860f6bd3b79f503f935a0a509bf7ca

Created January 8, 2021 18:47
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save malwareforme/3f860f6bd3b79f503f935a0a509bf7ca to your computer and use it in GitHub Desktop.
Save malwareforme/3f860f6bd3b79f503f935a0a509bf7ca to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (ElegyRAT)"; flow:established,to_client; tls.cert_subject; content:"CN=ElegyRAT Server"; fast_pattern; endswith; tls.cert_issuer; content:"CN=ElegyRAT Server"; endswith; reference:md5,a24cae9f6cf137e0e72817a1879f0acf; classtype:domain-c2; sid:10000000; rev:1;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment