Moriagent malware

[Jafar_Hussain]

Dear Team,

I don't have much idea about Moriagent malware, i got an instruction i need to create a rule or block this malware

 How to stop MortiAgent Malware using snort rule?

I want to stop the MoriAgent malware by applying /using snort rule.

How to configure this in Palo alto ?

Below are snort rule.

1. The below SNORT rule can be used to detect the MoriAgent Beacon.
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:" MoriAgent Beacon
HTTP Request"; content:"/Index.php?i="; depth:200; content:"&t="; within:64;
content:"HTTP/1.1"; within:64; content:"Content-Type: application/json"; within:32;
content:"Content-Length: 0"; within:90; threshold:type limit,track by_src,count
1,seconds 120; sid:1000001; rev:001;)

Can anyone help me to understand what I need to do, I searched about this but didn't get much information.

[OtakarKlier]

Hello,

If its a 'White' IOC notice, I wouldnt worry about it but I guess a EDL or a special policy with a block for those IP's would do.

Regards,

[Jafar_Hussain · Accepted solution]

@OtakarKlier 

Thanks. i have found the pattern of the signature.

(/Index.php?i= and &t and HTTP/1.1 and Content-Type: application/json)

In the custom signature which condition i need to follow "And" condition "OR" condition. and for the qualifier which information i need to add.