alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:9;)

Added 2008-07-11 19:00:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:9;)

Added 2008-07-11 19:00:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; content:!"GtekClient"; within:50; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:8;)

Added 2008-03-21 12:52:14 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; content:!"GtekClient"; within:50; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:8;)

Added 2008-03-21 12:52:14 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:7;)

Added 2008-03-04 19:25:59 UTC

The trailing semicolon after 98 was causing false negatives. Removed...

-- MattJonkman - 05 Mar 2008

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:7;)

Added 2008-03-04 19:25:59 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:6;)

Added 2008-02-28 19:02:43 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:6;)

Added 2008-02-28 19:02:43 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:100; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:4;)

Added 2008-02-09 22:28:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:100; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:4;)

Added 2008-02-09 22:28:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:3;)

Added 2008-01-31 18:48:10 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:3;)

Added 2008-01-31 18:48:10 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 17:42:41 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 17:42:41 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 15:15:19 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 15:15:19 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-08 20:25:20 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-08 20:25:20 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url.doc.bleedingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:1;)

Added 2007-11-13 02:32:17 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url.doc.bleedingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:1;)

Added 2007-11-13 02:29:18 UTC