TROJAN: Ebury Trojaned SSH Daemon DNS Data Exfiltration

This signature detects DNS packets used as a data exfiltration technique for the Trojan named "Ebury" discovered by security researcher Steinar Gunderson. An infected machine has its SSH daemon replaced with a malicious binary that collects usernames and passwords used to log in to the infected host, then sends those credentials to a listening post as DNS packets. The trojan also allows unlogged and unauthenticated remote login to the infected host. The source IP of this event in your logs may be a compromised SSH server that should be investigated.

References

URL: http://blog.sesse.net/blog/tech/2011-11-15-21-44_ebury_a_new_ssh_trojan.html

Short Name

TROJAN:EBURY-DNS-EXFILTRATION

Severity

Critical

Recommended

False

Recommended Action

Drop

TROJAN: Ebury Trojaned SSH Daemon DNS Data Exfiltration

References

Found a potential security threat?