alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE ZenoSearch? Spyware User-Agent"; flow:to_server,established; content:"|0d 0a|User-Agent\: ["; pcre:"/User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}/i"; classtype:trojan-activity; sid:2008279; rev:3;)

Added 2008-08-26 07:00:21 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE ZenoSearch? Spyware User-Agent"; flow:to_server,established; content:"|0d 0a|User-Agent\: ["; pcre:"/User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}/i"; classtype:trojan-activity; sid:2008279; rev:3;)

Added 2008-08-26 07:00:21 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE ZenoSearch? Spyware User-Agent"; flow:to_server,established; content:"|0d 0a|User-Agent\: ["; content:"]"; distance:0; within:15; pcre:"/User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}/i"; classtype:trojan-activity; sid:2008279; rev:2;)

Added 2008-08-12 10:51:04 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE ZenoSearch? Spyware User-Agent"; flow:to_server,established; content:"|0d 0a|User-Agent\: ["; content:"]"; distance:0; within:15; pcre:"/User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}/i"; classtype:trojan-activity; sid:2008279; rev:2;)

Added 2008-08-12 10:51:04 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE ZenoSearch? Spyware User-Agent"; flow:to_server,established; content:"|0d 0a|User-Agent\: ["; content:"]0"; distance:0; within:10; classtype:trojan-activity; sid:2008279; rev:1;)

Added 2008-06-06 20:49:01 UTC