alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Rootkit TDSS/Alureon Checkin 2"; flow:established,to_server; content:"/dx.php?i="; http_uri; content:"&x64="; http_uri; content:"os="; http_uri; content:"&a="; http_uri; content:"&f="; http_uri; pcre:"/dx\.php\?i=[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=/Ui"; reference:url,contagiodump.blogspot.com/2011/02/tdss-tdl-4-alureon-32-bit-and-64-bit.html; classtype:trojan-activity; sid:2012314; rev:1;)

Added 2011-10-12 19:33:57 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Rootkit TDSS/Alureon Checkin 2"; flow:established,to_server; content:"/dx.php?i="; http_uri; content:"&x64="; http_uri; content:"os="; http_uri; content:"&a="; http_uri; content:"&f="; http_uri; pcre:"/dx\.php\?i=[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=/Ui"; classtype:trojan-activity; reference:url,contagiodump.blogspot.com/2011/02/tdss-tdl-4-alureon-32-bit-and-64-bit.html; sid:2012314; rev:1;)

Added 2011-02-17 14:31:23 UTC


Topic revision: r1 - 2011-10-12 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats