alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-BACKDOOR access remote pc runtime detection - init connection"; flow:to_server,established; content:"|99 F3 00 00 00 00 00 00 FF FF FF FF|"; depth:12; flowbits:set,AccessRemotePC_detection; flowbits:noalert; classtype:trojan-activity; sid:12142; rev:3;)

  • 1
    There are many parts here. Please indicate which parts you already understand so that we don't have to explain what tcp means, for instance. – schroeder Nov 1 '15 at 18:17

It will 'alert' on any TCP connection from an external network to an internal network (DMZ) as long as the content of the packet matches '99 F3 00 00 00 00 00 00 FF FF FF FF' (which matches the BackoffPOS 1.56 process injection module).

While there is more to the rule; depth, setting the flowbits to a pre-defined class (AccessRemotePC_detection; used for easier reporting) as well as 'classtype', in simplest terms that is your rule breakdown.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.