SID 1:56166

Report a false positive

Rule Category

MALWARE-OTHER --

Alert Message

MALWARE-OTHER Win.Dropper.PyVil outbound communication attempt

Rule Explanation

This rule detects an outbound communication attempt from a variant of Win.Dropper.PyVil by looking for specific patterns in the outbound URI.

What To Look For

This rule detects an outbound communication attempt from a variant of Win.Dropper.PyVil.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

None

Additional Links

virustotal.com/gui/file/25c119a7ee5b53212b5992992907a7772610b491ce2992c860dc206d0f3f844d/detection
virustotal.com/gui/file/a81f152a31c03b45dbcf29439050bbe080b1f6308b032aebc0205886d1f41e5d/detection
virustotal.com/gui/file/e678ec3dbccfbd5cf0f303d2841e726ac7628044de5297bf9ebe791d66270a2f/detection

Rule Vulnerability

No information provided

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

None

MITRE ATT&CK Framework

Tactic: Initial Access

Technique: Spearphishing Attachment

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org