Signature Detail

WORM: Miniflame Command and Conrol Communication

This signature detects the command-and-control communication of miniflame, an independent, stripped down variant of famous botnet, Flame. The source IP might be infected and should be removed from network and analyzed for malicious activity.

References

• URL: http://vrt-blog.snort.org/2012/12/triggering-miniflames-c-communication.html
• URL: http://www.securelist.com/en/analysis/204792247/miniFlame_aka_SPE_Elvis_and_his_friends