Pingback Backdoor File Indicators
Detects the creation of specific files associated with the Pingback backdoor, which is known to establish an ICMP tunnel for command and control (C2) communications. The rule specifically looks for 'updata.exe' being created and 'C:\Windows\oci.dll' as the target filename, as described in the Trustwave report.
Sigma
