alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent|3a|"; nocase; http_header; content:" Gator"; nocase; fast_pattern; within:150; http_header; pcre:"/User-Agent\:[^\n]+Gator/Hi"; reference:url,doc.emergingthreats.net/2000026; classtype:policy-violation; sid:2000026; rev:37; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
Added 2018-09-13 19:37:01 UTC
Added 2018-09-13 17:52:18 UTC
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent|3a|"; nocase; http_header; content:" Gator"; nocase; fast_pattern; within:150; http_header; pcre:"/User-Agent\:[^\n]+Gator/Hi"; reference:url,doc.emergingthreats.net/2000026; classtype:policy-violation; sid:2000026; rev:37; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
Added 2017-08-07 20:55:09 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; reference:url,doc.emergingthreats.net/2000026; classtype:policy-violation; sid:2000026; rev:36;)
Added 2011-10-12 19:09:28 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; sid:2000026; rev:36;)
Added 2011-09-15 14:46:01 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; sid:2000026; rev:36;)
Added 2011-09-14 20:31:10 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:" Gator"; nocase; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Gator/iH"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid:2000026; rev:36;)
Added 2011-02-04 17:21:11 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid:2000026; rev:33;)
Added 2010-06-28 22:47:02 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid:2000026; rev:33;)
Added 2010-06-28 22:47:02 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid: 2000026; rev:33;)
Added 2009-11-25 11:39:03 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_AGENTS_Zango_Hotbar; sid: 2000026; rev:33;)
Added 2009-11-25 11:39:03 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)
Added 2009-02-09 21:30:23 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)
Added 2009-02-09 21:30:23 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)
Added 2009-02-09 21:29:24 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2000026; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_USER_Agents; sid: 2000026; rev:31;)
Added 2009-02-09 21:29:24 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; sid: 2000026; rev:30;)
Added 2008-05-09 17:01:40 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; sid: 2000026; rev:30;)
Added 2008-05-09 17:01:40 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; content:!"User-Agent\:
FeedDemon?"; classtype: policy-violation; sid: 2000026; rev:29;)
Added 2008-04-04 09:27:26 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; content:!"User-Agent\:
FeedDemon?"; classtype: policy-violation; sid: 2000026; rev:29;)
Added 2008-04-04 09:27:26 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:28;)
Added 2008-02-01 14:32:22 UTC
User-agent 'FeedDemon/2.6 (
http://www.newsgator.com/; Microsoft Windows XP)' gives false positives
--
UveLokk - 04 Apr 2008
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:28;)
Added 2008-02-01 14:32:22 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:18;)
Added 2008-01-28 17:24:20 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:18;)
Added 2008-01-28 17:24:20 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:17;)
Added 2007-09-05 12:33:03 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:17;)
Added 2007-09-05 12:33:03 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; classtype: policy-violation; sid: 2000026; rev:16;)
Added 2007-07-04 08:31:46 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Aventail Interrogator"; classtype: policy-violation; sid: 2000026; rev:15;)
Edit | Attach | Print version | History: r2 < r1 | Backlinks | Raw View | WYSIWYG | More topic actions
Main Web
Create New Topic
Index
Search
Changes
Preferences
Copyright © Emerging Threats