EmergingThreats> Main Web>2000026 (2008-04-04, UveLokk) EditAttach

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gator Agent Traffic"; flow:to_server,established; content:"Gator/"; http_user_agent; depth:6; reference:url,doc.emergingthreats.net/2000026; classtype:trojan-activity; sid:2000026; rev:38; metadata:created_at 2010_07_30, former_category USER_AGENTS, updated_at 2020_08_31;)

Added 2020-08-31 18:09:13 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gator Agent Traffic"; flow:to_server,established; content:"Gator/"; http_user_agent; depth:6; reference:url,doc.emergingthreats.net/2000026; classtype:trojan-activity; sid:2000026; rev:38; metadata:created_at 2010_07_30, former_category USER_AGENTS, updated_at 2019_08_07;)

Added 2020-08-05 19:01:21 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Gator Agent Traffic"; flow:to_server,established; content:"Gator/"; http_user_agent; depth:6; reference:url,doc.emergingthreats.net/2000026; classtype:policy-violation; sid:2000026; rev:38; metadata:created_at 2010_07_30, updated_at 2019_08_07;)

Added 2019-08-07 19:27:24 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent|3a|"; nocase; http_header; content:" Gator"; nocase; fast_pattern; within:150; http_header; pcre:"/User-Agent\:[^\n]+Gator/Hi"; reference:url,doc.emergingthreats.net/2000026; classtype:policy-violation; sid:2000026; rev:37; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2018-09-13 19:37:01 UTC

Added 2018-09-13 17:52:18 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent|3a|"; nocase; http_header; content:" Gator"; nocase; fast_pattern; within:150; http_header; pcre:"/User-Agent\:[^\n]+Gator/Hi"; reference:url,doc.emergingthreats.net/2000026; classtype:policy-violation; sid:2000026; rev:37; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-08-07 20:55:09 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; reference:url,doc.emergingthreats.net/2000026; classtype:policy-violation; sid:2000026; rev:36;)

Added 2011-10-12 19:09:28 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; sid:2000026; rev:36;)

Added 2011-09-15 14:46:01 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; sid:2000026; rev:36;)

Added 2011-09-14 20:31:10 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid:2000026; rev:36;)

Added 2011-02-04 17:21:11 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid:2000026; rev:33;)

Added 2010-06-28 22:47:02 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid:2000026; rev:33;)

Added 2010-06-28 22:47:02 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid: 2000026; rev:33;)

Added 2009-11-25 11:39:03 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid: 2000026; rev:33;)

Added 2009-11-25 11:39:03 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)

Added 2009-02-09 21:30:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)

Added 2009-02-09 21:30:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)

Added 2009-02-09 21:29:24 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)

Added 2009-02-09 21:29:24 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; sid: 2000026; rev:30;)

Added 2008-05-09 17:01:40 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; sid: 2000026; rev:30;)

Added 2008-05-09 17:01:40 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; content:!"User-Agent\: FeedDemon?"; classtype: policy-violation; sid: 2000026; rev:29;)

Added 2008-04-04 09:27:26 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; content:!"User-Agent\: FeedDemon?"; classtype: policy-violation; sid: 2000026; rev:29;)

Added 2008-04-04 09:27:26 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:28;)

Added 2008-02-01 14:32:22 UTC

User-agent 'FeedDemon/2.6 (http://www.newsgator.com/; Microsoft Windows XP)' gives false positives

-- UveLokk - 04 Apr 2008

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:28;)

Added 2008-02-01 14:32:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:18;)

Added 2008-01-28 17:24:20 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:18;)

Added 2008-01-28 17:24:20 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:17;)

Added 2007-09-05 12:33:03 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:17;)

Added 2007-09-05 12:33:03 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; classtype: policy-violation; sid: 2000026; rev:16;)

Added 2007-07-04 08:31:46 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Aventail Interrogator"; classtype: policy-violation; sid: 2000026; rev:15;)

Edit | Attach | Print version | History: r2 < r1 | Backlinks | Raw View | WYSIWYG | More topic actions
Topic revision: r2 - 2008-04-04 - UveLokk
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats