topic JawinaBug Command and Control Traffic Detection(85599) in General Topics

JawinaBug Command and Control Traffic Detection(85599)

Lalitb — Tue, 11 Feb 2020 13:19:24 GMT

Could you guys please throw some light on "JawinaBug Command and Control Traffic Detection(85599)", there is no information related to could you guys please throw some light on "JawinaBug Command and Control Traffic Detection(85599)", there is no information related to JawinaBug at all

What triggers this signature, what are the IOCs?, Please help

I have seen this signature triggering in internal communication with SQL server.

All I know so far is that the signature is fairly new and by default action of the firewall is reset both connections

Re: JawinaBug Command and Control Traffic Detection(85599)

reaper — Tue, 11 Feb 2020 15:19:36 GMT

if you enable extended threat pcap, you can see what triggered the signature

Re: JawinaBug Command and Control Traffic Detection(85599)

kiwi — Wed, 12 Feb 2020 07:55:42 GMT

Hi @Lalitb ,

To add to reaper's comment... you enable the extended_pcap in the vulnerability profile:

You can edit the length of the extended_pcap as well :

Extended PCAP Length

Hope this helps,

-Kiwi.