ET MALWARE UPDATE Protocol Trojan Communication detected on http ports

7.0.35.0SID: 2014223Rev: 6Disabled1 views
Sourceet/open
Fileemerging-malware.rules
CreatedFebruary 14, 2012
UpdatedApril 8, 2024
Classificationtrojan-activity
alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE UPDATE Protocol Trojan Communication detected on http ports"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/update?product=windows"; fast_pattern; http.user_agent; bsize:54; content:"Mozilla|2f|4|2e|0|20 28|compatible|3b 20|MSIE|20|6|2e|0|3b 20|Windows|20|NT|20|5|2e|1|3b|SV1|3b|"; http.header_names; content:"|0d 0a|X-Status|0d 0a|"; content:"|0d 0a|X-Size|0d 0a|"; content:"|0d 0a|X-Sn|0d 0a|"; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014223; rev:6; metadata:created_at 2012_02_14, signature_severity Major, updated_at 2024_04_08;)

References

urlwww.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf

Metadata

created at2012_02_14
signature severityMajor
updated at2024_04_08

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!