Think you have a false positive on this rule?

Sid 1-51535

Message

MALWARE-BACKDOOR TLS certificate securing LocalXpose reverse proxy backdoor

Summary

This event is generated when the LocalXpose backdoor attempts to securely connect to CNC proxy infrastructure.

Impact

A backdoor tunnel into the network is being opened.

Detailed information

Affected systems

Ease of attack

False positives

False negatives

Corrective action

Contributors

  • Cisco Talos Intelligence Group

Additional References

  • virustotal.com/#/file/227c127b4614dfb4631b44f40c8f98c6549c7238bc3b70af74e5a7b9170cbe85/detection