# Hydrochasma (Fast Reverse Proxy)

**URL:** <https://community.emergingthreats.net/t/hydrochasma-fast-reverse-proxy/727>\
**Category:** Rule Signatures\
**Created:** [July 5, 2023, 5:32am UTC](https://community.emergingthreats.net/t/hydrochasma-fast-reverse-proxy/727 "2023-07-05T05:32:36Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [July 7, 2023, 10:20am UTC](https://community.emergingthreats.net/t/hydrochasma-fast-reverse-proxy/727/3 "2023-07-07T10:20:01Z")

</div>

Forgive me for my insistence, I revised the detection criteria to focus on the content. Here I have added a few bytes from the TLS handshake and suggest checking the following rule:

```auto
alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] Hydrochasma Fast Reverse Proxy"; flow: established, to_server; content: "|10 61 62 16 03 01 00 ee 01 00 00 ea 03 03|";depth:14; classtype: command-and-control;reference:md5,8d4f9c64ba15f7cabd81936d1c8c83d4;reference:url,app.any.run/tasks/128bd923-3347-4a7f-8261-9a4c7cb29ea8;metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family hydrochasma, created_at 2023_07_07;sid: 1; rev: 1;)

```

---

_[View the full topic](https://community.emergingthreats.net/t/hydrochasma-fast-reverse-proxy/727)._