SCAN: Canvas Helium Agent (1)

This signature detects Helium, a python-based Trojan installed after a system is exploited by the Canvas Framework from Immunitysec. By default, Canvas uses port 31337, but an attacker can configure Canvas to use any port. Remote attackers can use the Helium Trojan to gain full access to the infected host, including loading programs such as port scanners, exploits, and distributed computing modules.

Short Name

SCAN:CANVAS:HELIUM-AGENT-1

Severity

Major

Recommended

False

Recommended Action

Drop

SCAN: Canvas Helium Agent (1)

Found a potential security threat?