alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE
SideStep? Bar Update Reporting"; flow: to_server,established; uricontent:"/wutrack.bin?PUID="; nocase; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2001020; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_SideStep_Bar; sid: 2001020; rev:8;)
Added 2009-02-09 21:15:24 UTC
This was triggered by a Windows Update request:
GET /wutrack.bin?PUID=0&PLAT=18&LOCALE=0x00000409&STATUS=DUNODRIVER&GUID=0&PNPID=ACPI\IBM0
068 HTTP/1.0
Accept: */*
User-Agent: Dynamic Update
Host: windowsupdate.microsoft.com
--
DavidSchweikert - 04 Mar 2009
Dropping the sig. The current client does not appear to use this method any longer. Thanks for the report David!
Matt
--
MattJonkman - 04 Mar 2009
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE
SideStep? Bar Update Reporting"; flow: to_server,established; uricontent:"/wutrack.bin?PUID="; nocase; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; classtype: policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/2001020; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/MALWARE/MALWARE_SideStep_Bar; sid: 2001020; rev:8;)
Added 2009-02-09 21:15:24 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE
SideStep? Bar Update Reporting"; flow: to_server,established; uricontent:"/wutrack.bin?PUID="; nocase; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; classtype: policy-violation; sid: 2001020; rev:7;)
Added 2008-01-28 17:24:18 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE
SideStep? Bar Update Reporting"; flow: to_server,established; uricontent:"/wutrack.bin?PUID="; nocase; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; classtype: policy-violation; sid: 2001020; rev:7;)
Added 2008-01-28 17:24:18 UTC
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware
SideStep? Bar Update Reporting"; flow: to_server,established; uricontent:"/wutrack.bin?PUID="; nocase; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; classtype: policy-violation; sid: 2001020; rev:6; )