JawinaBug Command and Control Traffic Detection(85599)

[Lalitb]

Could you guys please throw some light on "JawinaBug Command and Control Traffic Detection(85599)", there is no information related to could you guys please throw some light on "JawinaBug Command and Control Traffic Detection(85599)", there is no information related to JawinaBug at all

What triggers this signature, what are the IOCs?, Please help

I have seen this signature triggering in internal communication with SQL server. 

All I know so far is that the signature is fairly new and by default action of the firewall is reset both connections

[reaper]

if you enable extended threat pcap, you can see what triggered the signature

[kiwi]

Hi @Lalitb ,

To add to reaper's comment... you enable the extended_pcap in the vulnerability profile:

You can edit the length of the extended_pcap as well :

Extended PCAP Length

Hope this helps,

-Kiwi.