Cavern Manticore n-sws.dll SOCKS5-over-WebSocket tunnel handshake to internal host
Detects a specific network handshake pattern indicative of the Cavern Manticore malware establishing a SOCKS5-over-WebSocket tunnel. The rule monitors for a WebSocket upgrade request followed by the initial SOCKS5 connection authentication byte sequence.
Suricata
