SHELLCODE: X86 Microsoft Win32 Export Table Enumeration Variant Detection Over TCP-STC
This signature detects payloads being transferred over network that have been using x86 Microsoft Win32 export table enumeration variant. This may be an indication of someone trying to evade anti-virus/IPS solutions and possibly drop malicious code.
Short Name
SHELLCODE:X86:WIN32-ENUM-STC
Severity
Critical
Recommended
True
Recommended Action
Drop
Category
SHELLCODE
Keywords
Detection Enumeration Export Microsoft Over TCP-STC Table Variant Win32 X86
Release Date
08/17/2015
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3324
Port
TCP/0-79,81-442,444-3127,3129-7999,8001-8079,8081-65535
False Positive
Unknown