# NEW SIG: ET TROJAN Falsefont.Backdoor APT33 Initial Handshake

**URL:** <https://community.emergingthreats.net/t/new-sig-et-trojan-falsefont-backdoor-apt33-initial-handshake/1497>\
**Category:** Rule Signatures\
**Created:** [March 22, 2024, 10:00am UTC](https://community.emergingthreats.net/t/new-sig-et-trojan-falsefont-backdoor-apt33-initial-handshake/1497 "2024-03-22T10:00:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [March 22, 2024, 10:00am UTC](https://community.emergingthreats.net/t/new-sig-et-trojan-falsefont-backdoor-apt33-initial-handshake/1497/1 "2024-03-22T10:00:21Z")

</div>

The URL should be unit42[.]paloaltonetworks[.]com/curious-serpens-falsefont-backdoor/ but I could not add this for some reason when posting to the community so it will need added back into the rule below

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET TROJAN Falsefont.Backdoor APT33 Initial Handshake”; flow:established,to\_server; content:“POST”; http\_method; content:“/api/Token”; http\_uri; depth:10; content:!“User-Name|3A|”; http\_header; content:“{|22|username|22|:|22|”; http\_client\_body; depth:16; content:“|22|password|22|:|22|”; http\_client\_body; distance:0; content:“|22|computerHostName|22|:|22|”; http\_client\_body; distance:0; content:“|22|computerHostName|22|:|22|”; http\_client\_body; distance:0; content:“|22|computerUserName|22|:|22|”; http\_client\_body; distance:0; content:“|22|osName|22|:|22|”; http\_client\_body; distance:0; classtype:trojan-activity; reference:url,REFERENCE; sid:133111; rev:1;)

Kind Regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\
**Post date:** [March 22, 2024, 8:10pm UTC](https://community.emergingthreats.net/t/new-sig-et-trojan-falsefont-backdoor-apt33-initial-handshake/1497/2 "2024-03-22T20:10:59Z")

</div>

Hi Kevin,

This activity should be covered under 2049963 - ET MALWARE Suspected TA451 Related FalseFont Backdoor Activity M3

Are you seeing a FN for that?

JT