https://community.cisco.com/t5/network-security/malware-cnc-win-trojan-gh0st-variant-outbound-connection/m-p/3302856#M1041447 <P>Can someone assist me in finding IoC on host system related to this particular IPS event.&nbsp; I read somewhere that they could be false positive events linked to device that perform some security related function. Traffic source is from Shodan (66.250.205.34) reported by Firepower ASA.</P> <P>&nbsp;</P> <P>External Reference to IPS event:</P> <P><A href="https://www.volexity.com/blog/2017/03/23/have-you-been-haunted-by-the-gh0st-rat-today/" target="_blank">https://www.volexity.com/blog/2017/03/23/have-you-been-haunted-by-the-gh0st-rat-today/</A></P> Fri, 21 Feb 2020 15:02:12 GMT d@rkNit3_76 2020-02-21T15:02:12Z https://community.cisco.com/t5/network-security/malware-cnc-win-trojan-gh0st-variant-outbound-connection/m-p/3302856#M1041447 <P>Can someone assist me in finding IoC on host system related to this particular IPS event.&nbsp; I read somewhere that they could be false positive events linked to device that perform some security related function. Traffic source is from Shodan (66.250.205.34) reported by Firepower ASA.</P> <P>&nbsp;</P> <P>External Reference to IPS event:</P> <P><A href="https://www.volexity.com/blog/2017/03/23/have-you-been-haunted-by-the-gh0st-rat-today/" target="_blank">https://www.volexity.com/blog/2017/03/23/have-you-been-haunted-by-the-gh0st-rat-today/</A></P> Fri, 21 Feb 2020 15:02:12 GMT https://community.cisco.com/t5/network-security/malware-cnc-win-trojan-gh0st-variant-outbound-connection/m-p/3302856#M1041447 d@rkNit3_76 2020-02-21T15:02:12Z https://community.cisco.com/t5/network-security/malware-cnc-win-trojan-gh0st-variant-outbound-connection/m-p/3765021#M1041449 <P>I was curious if you find a solution....</P> Mon, 17 Dec 2018 13:15:36 GMT https://community.cisco.com/t5/network-security/malware-cnc-win-trojan-gh0st-variant-outbound-connection/m-p/3765021#M1041449 rick11 2018-12-17T13:15:36Z