Overview
Write Snort rules for the command and control (C2) traffic used by TVRat (a remote access trojan leveraging the legitimate TeamViewer application)
Proposal
Write Snort rules (likely two) for Predator the Thief C2 traffic. For more info, see:
Expected Difficulty
Beginner/Easy - The C2 protocol is very basic, write-ups exist that detail the purpose of the protocol data, etc.
Technical Info
https://app.any.run/tasks/686989ed-f442-4463-afe5-2b547bf17485/
https://app.any.run/tasks/859c1d99-72d7-4d5e-a9fb-5ad157fa73b4/
tvrat-pcaps.zip (password: infected)
Overview
Write Snort rules for the command and control (C2) traffic used by TVRat (a remote access trojan leveraging the legitimate TeamViewer application)
Proposal
Write Snort rules (likely two) for Predator the Thief C2 traffic. For more info, see:
Expected Difficulty
Beginner/Easy - The C2 protocol is very basic, write-ups exist that detail the purpose of the protocol data, etc.
Technical Info
https://app.any.run/tasks/686989ed-f442-4463-afe5-2b547bf17485/
https://app.any.run/tasks/859c1d99-72d7-4d5e-a9fb-5ad157fa73b4/
tvrat-pcaps.zip (password:
infected)