SCAN: Canvas Helium Agent

This signature detects Helium, a python-based Trojan installed after a system is exploited by the Canvas Framework from Immunitysec. By default, Canvas uses port 31337, but an attacker can configure Canvas to use any port. Remote attackers can use the Helium Trojan to gain full access to the infected host, including loading programs such as port scanners, exploits, and distributed computing modules.

Extended Description

The Helium trojan allows an attacker to gain full access to an infected server, and to load programs.

References

URL: http://www.immunitysec.com/products-hydrogen.shtml

Short Name

SCAN:CANVAS:HELIUM-AGENT

Severity

Critical

Recommended

False

Recommended Action

Drop

SCAN: Canvas Helium Agent

Extended Description

References

Found a potential security threat?