ET CURRENT_EVENTS Fake Trojan Dropper purporting to be missing application - findloader

7.0.35.0SID: 2017302Rev: 3Disabled0 views
Sourceet/open
Fileemerging-current_events.rules
CreatedAugust 8, 2013
UpdatedMarch 17, 2024
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Fake Trojan Dropper purporting to be missing application - findloader"; flow:established,to_server; http.uri; content:"/findloader"; fast_pattern; content:".php?"; distance:0; pcre:"/findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$/"; classtype:trojan-activity; sid:2017302; rev:3; metadata:created_at 2013_08_08, signature_severity Major, updated_at 2024_03_17;)

Metadata

created at2013_08_08
signature severityMajor
updated at2024_03_17

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!