Trojan: Wiper/Flame HTTP POST Data Exfiltration Activity
This signature detects HTTP POST activity for an unknown version of Wiper, also known as Viper, sKyWiper, or Flame during its data exfiltration process. The source IP address is possibly infected and should be investigated.
References
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3