SID 1:64406

Rule Category

MALWARE-OTHER --

Alert Message

MALWARE-OTHER Win.Trojan.WinOS4 download attempt

Rule Explanation

This rule alerts on file downloads of Win.Trojan.WinOS4. WinOS 4.0 is an post-exploitation framework derived from ghostRat that is used to establish persistent access to an infected machine.

What To Look For

This rule alerts on file downloads of Win.Trojan.WinOS4.

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group