alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; http_uri; content:"&id="; http_uri; content:"&t="; http_uri; content:"&i="; http_uri; pcre:"/\?n=\d+&id=.+&t=.+&i=\d/Ui"; reference:url,doc.emergingthreats.net/2009300; classtype:trojan-activity; sid:2009300; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-08-07 21:02:26 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; http_uri; content:"&id="; http_uri; content:"&t="; http_uri; content:"&i="; http_uri; pcre:"/\?n=\d+&id=.+&t=.+&i=\d/Ui"; reference:url,doc.emergingthreats.net/2009300; classtype:trojan-activity; sid:2009300; rev:5;)

Added 2012-09-28 00:08:32 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; http_uri; content:"&id="; http_uri; content:"&t="; http_uri; content:"&i="; http_uri; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; reference:url,doc.emergingthreats.net/2009300; classtype:trojan-activity; sid:2009300; rev:4;)

Added 2011-10-12 19:27:04 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; http_uri; content:"&id="; http_uri; content:"&t="; http_uri; content:"&i="; http_uri; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009300; sid:2009300; rev:4;)

Added 2011-09-14 22:40:26 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; http_uri; content:"&id="; http_uri; content:"&t="; http_uri; content:"&i="; http_uri; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009300; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Small.zon; sid:2009300; rev:4;)

Added 2011-02-04 17:28:36 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; uricontent:"&id="; uricontent:"&t="; uricontent:"&i="; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009300; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Small.zon; sid:2009300; rev:2;)

Added 2009-05-04 14:15:33 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; uricontent:"&id="; uricontent:"&t="; uricontent:"&i="; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009300; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Small.zon; sid:2009300; rev:2;)

Added 2009-05-04 14:15:33 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; uricontent:"&id="; uricontent:"&t="; uricontent:"&i="; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009300; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Small.zon; sid:2009300; rev:2;)

Added 2009-05-04 14:13:16 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; uricontent:"&id="; uricontent:"&t="; uricontent:"&i="; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009300; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Small.zon; sid:2009300; rev:2;)

Added 2009-05-04 14:13:16 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Small.zon checkin"; flow:established,to_server; content:"GET "; depth:4; uricontent:"?n="; uricontent:"&id="; uricontent:"&t="; uricontent:"&i="; pcre:"/\?n=\d+&id=.+&t=.+&i=\d+/Ui"; classtype:trojan-activity; sid:2009300; rev:1;)

Added 2009-05-04 09:52:15 UTC


Topic revision: r1 - 2017-08-08 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats