tcpsocket[.]newDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Cups Overflow: When your printer spills more than Ink“"*GS_ARGS=*", "*/dev/tcp*", "*/dev/udp/*", "*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket[.]new*",”
Indicators reported together
named in the same reports- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_shell_execution.tomlin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.tomlin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/command_and_control_cupsd_foomatic_rip_netcon.tomlin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_file_creation.tomlin 1 report
- hxxps://github[.]com/elastic/detection-rules/blob/a3e89a7fabe90a6f9ce02b58d5a948db8d231ee5/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution.tomlin 1 report
- hxxps://www.evilsocket[.]net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/in 1 report
- www.evilsocket[.]netin 1 report
- hxxps://github[.]com/RickdeJager/cupshax/blob/main/cupshax.pyin 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2011-2697, CVE-2011-2964, CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47177
Thanks — we review every report.