ET CURRENT_EVENTS Win32.RBrute http response
Sourceet/open
Fileemerging-current_events.rules
CreatedApril 4, 2014
UpdatedApril 14, 2024
Classificationtrojan-activity
alert http any 80 -> any any (msg:"ET CURRENT_EVENTS Win32.RBrute http response"; flow:established,to_client ; flowbits:isset,ET.Rbrute.incoming ; file.data; content:"<html>kenji oke</html>|0d 0a|"; startswith; reference:md5,055a9be75e469f8817c9311390a449f6 ; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/ ; classtype:trojan-activity; sid:2018356; rev:6; metadata:created_at 2014_04_04, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_14;)
References
| md5 | 055a9be75e469f8817c9311390a449f6 |
| url | www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/ |
Metadata
created at2014_04_04
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_04_14
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!