Pingback Backdoor DLL Loading Activity
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
detection:
selection:
Image|endswith: '\msdtc.exe'
ImageLoaded: 'C:\Windows\oci.dll'
condition: selectionFalse positives are unlikely for most environments. High confidence detection.
Sub-techniques
Other
Pingback Backdoor DLL Loading Activity
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects similar activity. Both rules may fire on overlapping events.
Pingback Backdoor Activity
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects similar activity. Both rules may fire on overlapping events.