Skip to content

Instantly share code, notes, and snippets.

@silence-is-best

silence-is-best/gist:cb08724865ab93dd369a8817062241ac

Created May 11, 2022 17:13
Show Gist options
  • Save silence-is-best/cb08724865ab93dd369a8817062241ac to your computer and use it in GitHub Desktop.
Save silence-is-best/cb08724865ab93dd369a8817062241ac to your computer and use it in GitHub Desktop.
Download ZIP
Evil ConnectWise-ScreenConnect snort suricata sig
Raw
gistfile1.txt
alert tcp any any -> any any (msg:"ScreenConnect-ConnectWise Initial Checkin"; content:"|87 15 10 00 00 00 00 00 00 00 00 00 00 00 00 00|"; fast_pattern; within:16; dsize:<600; classtype:trojan-activity; sid:20166341; rev:1; metadata:created_at 2022_05_11;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment