SIG: ET MALWARE Gamaredon TryCloudFlare Activity - Known Delimiter in User-Agent

Rule Signatures
1

alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET MALWARE Gamaredon APT TryCloudFlare Activity - Known Delimiter in User-Agent”; flow:established,to_server; http.host; content:“.trycloudflare.com”; http.user_agent; content:“|3B 3B|/.”; classtype:trojan-activity; reference:url,Inside Gamaredon's PteroLNK: Dead Drop Resolvers and evasive Infrastructure - HarfangLab | Your endpoints, our protection; sid:154001; rev:1;)

Kind Regards,
Kevin Ross

1 Like
2

hey @kevross33 - thanks for sending our way! Here are the sid details:

  2062541 - Gamaredon APT TryCloudFlare CnC Activity - Known Delimiter in User-Agent