SIG: ET TROJAN SocGholish/Ghostweaver PowerShell Boinc Download Request

Rule Signatures
1

Below the backslashes on the pcre aren’t showing when I have submitted under this. It will need added if not present to the dot before php and ? in the URI.

alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SocGholish/Ghostweaver PowerShell Boinc Download Request”; flow:established,to_server; http_uri; content:“.php?s=boicn”; fast_pattern:only; http.user_agent; content:“WindowsPowerShell/”; pcre:“/.php?s=boicn$/Ui”; classtype:trojan-activity; reference:url,Don’t Ghost the SocGholish: GhostWeaver Backdoor | by TRAC Labs | Feb, 2025 | Medium; reference:url,Fake Browser Updates Lead to BOINC Volunteer Computing Software | Huntress; sid:152001; rev:1;)

Kind regards,
Kevin Ross

1 Like
2

Hi Kevin,

Thank you for the signature. It should appear in today’s release.

On the topic of formatting signatures in Discourse, using the preformatted options would allow you to share the signatures as intended: Posting code or preformatted text.

Cheers!
:hotdog:

1 Like
3

Thanks @kevross33 @bingohotdog !