2027421 < Main < EmergingThreats

Main Web>2027421 (2020-11-19, TWikiGuest) (raw view)
 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LNKR CnC Activity M3"; flow:established,to_server; content:"GET"; http_method; content:"/metric/?mid="; http_uri; depth:13; fast_pattern; content:"&wid="; http_uri; distance:0; within:20; content:"&sid="; http_uri; distance:0; within:20; content:"&tid="; http_uri; distance:0; within:20; content:"&rid="; http_uri; distance:0; within:20; content:"&t="; http_uri; distance:0; threshold: type limit, track by_dst, count 1, seconds 120; reference:url,securitytrails.com/blog/lnkr-malicious-browser-extension; classtype:trojan-activity; sid:2027421; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2019_06_03, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Minor, updated_at 2020_11_19;)

</h2>

Added 2020-11-19 18:26:24 UTC


 %COMMENT{type="threadmode" default="Please enter documentation, comments, false positives, or concerns with this signature. Press the Attach button below to add samples or Pcaps." button="Add to Documentation" }%
 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LNKR CnC Activity M3"; flow:established,to_server; content:"GET"; http_method; content:"/metric/?mid="; http_uri; depth:13; fast_pattern; content:"&wid="; http_uri; distance:0; within:20; content:"&sid="; http_uri; distance:0; within:20; content:"&tid="; http_uri; distance:0; within:20; content:"&rid="; http_uri; distance:0; within:20; content:"&t="; http_uri; distance:0; threshold: type limit, track by_dst, count 1, seconds 120; reference:url,securitytrails.com/blog/lnkr-malicious-browser-extension; classtype:trojan-activity; sid:2027421; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2019_06_03, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Minor, updated_at 2020_08_19;)

</h2>

Added 2020-08-19 18:14:34 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LNKR CnC Activity M3"; flow:established,to_server; content:"GET"; http_method; content:"/metric/?mid="; http_uri; depth:13; fast_pattern; content:"&wid="; http_uri; distance:0; within:20; content:"&sid="; http_uri; distance:0; within:20; content:"&tid="; http_uri; distance:0; within:20; content:"&rid="; http_uri; distance:0; within:20; content:"&t="; http_uri; distance:0; threshold: type limit, track by_dst, count 1, seconds 120; reference:url,securitytrails.com/blog/lnkr-malicious-browser-extension; classtype:trojan-activity; sid:2027421; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2019_06_03, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Minor, updated_at 2019_06_03;)

</h2>

Added 2020-08-05 19:16:19 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LNKR CnC Activity M3"; flow:established,to_server; content:"GET"; http_method; content:"/metric/?mid="; http_uri; depth:13; fast_pattern; content:"&wid="; http_uri; distance:0; within:20; content:"&sid="; http_uri; distance:0; within:20; content:"&tid="; http_uri; distance:0; within:20; content:"&rid="; http_uri; distance:0; within:20; content:"&t="; http_uri; distance:0; threshold: type limit, track by_dst, count 1, seconds 120; metadata: former_category ADWARE_PUP; reference:url,securitytrails.com/blog/lnkr-malicious-browser-extension; classtype:trojan-activity; sid:2027421; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor, created_at 2019_06_03, performance_impact Low, updated_at 2019_06_03;)

</h2>

Added 2019-09-19 19:27:10 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LNKR CnC Activity M3"; flow:established,to_server; content:"GET"; http_method; content:"/metric/?mid="; http_uri; depth:13; fast_pattern; content:"&wid="; http_uri; distance:0; within:20; content:"&sid="; http_uri; distance:0; within:20; content:"&tid="; http_uri; distance:0; within:20; content:"&rid="; http_uri; distance:0; within:20; content:"&t="; http_uri; distance:0; threshold: type limit, track by_dst, count 1, seconds 120; metadata: former_category MALWARE; reference:url,securitytrails.com/blog/lnkr-malicious-browser-extension; classtype:trojan-activity; sid:2027421; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor, created_at 2019_06_03, performance_impact Low, updated_at 2019_06_03;)

</h2>

Added 2019-08-15 20:33:42 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LNKR CnC Activity M3"; flow:established,to_server; content:"GET"; http_method; content:"/metric/?mid="; http_uri; depth:13; fast_pattern; content:"&wid="; http_uri; distance:0; within:20; content:"&sid="; http_uri; distance:0; within:20; content:"&tid="; http_uri; distance:0; within:20; content:"&rid="; http_uri; distance:0; within:20; content:"&t="; http_uri; distance:0; threshold: type limit, track by_dst, count 1, seconds 120; metadata: former_category MALWARE; reference:url,securitytrails.com/blog/lnkr-malicious-browser-extension; classtype:trojan-activity; sid:2027421; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor, created_at 2019_06_03, performance_impact Low, updated_at 2019_06_03;)

</h2>

Added 2019-06-03 18:23:57 UTC


 
 <hr>
Topic revision: r1 - 2020-11-19 - TWikiGuest
Main
User Reference
ATasteOfTWiki
TextFormattingRules
Signature Reference
WebRss Feed
EmergingFAQ