# DCRat Sig Submission

**URL:** <https://community.emergingthreats.net/t/dcrat-sig-submission/262>\
**Category:** Rule Signatures\
**Created:** [January 12, 2023, 2:29pm UTC](https://community.emergingthreats.net/t/dcrat-sig-submission/262 "2023-01-12T14:29:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cosmicgumbo](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@cosmicgumbo](https://community.emergingthreats.net/u/cosmicgumbo)\
**Post date:** [January 12, 2023, 2:29pm UTC](https://community.emergingthreats.net/t/dcrat-sig-submission/262/1 "2023-01-12T14:29:07Z")

</div>

Let me know if you need anything of me from this. Most of my thoughts are in the link.

> <https://github.com/eatinsundip/Suricata/blob/main/ET_Open_Submissions/2023/January/DCRat_Activity_01092023/README.md>

---

<div class="post-metadata">

**Author:** ![bmurphy](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@bmurphy](https://community.emergingthreats.net/u/bmurphy)\
**Post date:** [January 12, 2023, 7:13pm UTC](https://community.emergingthreats.net/t/dcrat-sig-submission/262/2 "2023-01-12T19:13:09Z")

</div>

Hello @cosmicgumbo!

Thanks for this signature submission, I’m a fan of this format.

I’ll get your telegram rule in with today’s release. I have tweaked the name a bit to indicate it’s a Telegram Checkin and modified the fast\_pattern to one of the content matches.

~~I’ll provide a sid once the rule has been published!~~  
This is in the ruleset now!  
2043288 - ET MALWARE DCRAT Checkin via Telegram

> This [triage](https://tria.ge/230107-fa3jqagb8t/behavioral3) run for DCRat fired an older rule of **2034194**.
> 
> `alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DCRAT Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".php?"; content: "&"; pcre: "/^(?:[a-f0-9]{2}){16}=(?:[a-f0-9]{2}){16}&(?:[a-f0-9]{2}){16}=(?=[a-z0-9A-Z]{0,32}[A-Z][a-z][A-Z][a-z][A-Z])/R"; http.header_names; content:"|0d 0a|Accept|0d 0a|Content-Type|0d 0a|User-Agent|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; bsize:56; fast_pattern; reference:url,twitter.com/James_inthe_box/status/1448751827046985746; reference:md5,60cf8c1093d596a44dc997d00caae463; classtype:trojan-activity; sid:2034194; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_10_15, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2021_10_15;)`
> 
> This newer [triage](https://tria.ge/230107-eynj2acf87/behavioral2) instance I found and re-ran did not trip anything but some informational alerts.

Do you have an idea why 2034194 FNs on the newer [Triage run](https://tria.ge/230107-eynj2acf87/behavioral2)?

---

<div class="post-metadata">

**Author:** ![bmurphy](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@bmurphy](https://community.emergingthreats.net/u/bmurphy)\
**Post date:** [January 12, 2023, 8:32pm UTC](https://community.emergingthreats.net/t/dcrat-sig-submission/262/3 "2023-01-12T20:32:27Z")

</div>

> [@bmurphy](#):
>
> Do you have an idea why 2034194 FNs on the newer [Triage run](https://tria.ge/230107-eynj2acf87/behavioral2)?

Got this tweaked up and a fix going to for today’s release! Thanks for pointing out this FN!