IDS: ET MOBILE_MALWARE XML Style POST Of IMSI International Mobile Subscriber Identity

Опубликовано 03.07.2024

Разбор сигнатуры IDS: ET MOBILE_MALWARE XML Style POST Of IMSI International Mobile Subscriber Identity

Table of Contents

Описание

Сигнатура обнаруживает запросы из локальной сети во внешнюю сеть, POST запроса (веб), содержащий в теле запроса строки <IMSI> или <|2F|IMSI, без учета регистра.

Сигнатура

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE XML Style POST Of IMSI International Mobile Subscriber Identity"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"<IMSI>"; nocase; content:"<|2F|IMSI"; nocase; distance:0; reference:url,www.learntelecom.com/telephony/gsm/international-mobile-subscriber-identity-imsi; classtype:trojan-activity; sid:2013139; rev:3; metadata:created_at 2011_06_30, updated_at 2020_04_20;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE XML Style POST Of IMSI International Mobile Subscriber Identity"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"<IMSI>"; nocase; content:"<|2F|IMSI"; nocase; distance:0; reference:url,www.learntelecom.com/telephony/gsm/international-mobile-subscriber-identity-imsi; classtype:trojan-activity; sid:2013139; rev:3; metadata:created_at 2011_06_30, updated_at 2020_04_20;)