SCAN: Core Impact Agent Loading (win32)

This signature detects the transfer and first loading of a Core Impact Agent over the network. This agent provides the attacker with full control over the victim computer. Detecting this transfer indicates that a successful exploitation is going on, which must be stopped immediately to mitigate the consequences.

Extended Description

The CORE IMPACT agent can be used to execute arbitrary shell commands on a compromised Windows system. The agent may obtain additional Windows APIs as binary plug-ins providing additional functionality to compromise other systems or disrupt network operations.

References

URL: http://www.coresecurity.com/products/coreimpact/index.php

Short Name

SCAN:CORE:AGENT-LOAD-WIN

Severity

Critical

Recommended

False

Recommended Action

Drop

SCAN: Core Impact Agent Loading (win32)

Extended Description

References

Found a potential security threat?