Remote Tool Installed After Voice Phishing Call
This rule detects the download of common remote access tools (AnyDesk, TeamViewer, RustDesk, Zoho, Atera, UltraViewer) over HTTP. The detection is triggered when an HTTP response flows to the client, is established, contains a URI, and the URI matches one of the specified tool names using a case-insensitive PCRE. Additionally, the response body size must be greater than 100,000 bytes, indicating a potential executable or installer download. This activity is classified as trojan activity and is associated with the MITRE ATT&CK technique T1566.004 (Phishing: Voice Phishing) and tactic Initial Access, suggesting that the download might occur after a voice phishing call.
Suricata
