#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST"; nocase; http_method; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"r="; http_client_body; content:"&i="; http_client_body; content:"&v="; http_client_body; content:"&os="; http_client_body; content:"&s="; http_client_body; content:"&h="; http_client_body; content:"&d="; http_client_body; content:"&panic"; http_client_body; content:"&ie="; http_client_body; content:"&input="; http_client_body; content:"&c="; http_client_body; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; classtype:trojan-activity; sid:2008443; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2018-09-13 19:39:55 UTC

Added 2018-09-13 17:53:53 UTC

#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST"; nocase; http_method; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"r="; http_client_body; content:"&i="; http_client_body; content:"&v="; http_client_body; content:"&os="; http_client_body; content:"&s="; http_client_body; content:"&h="; http_client_body; content:"&d="; http_client_body; content:"&panic"; http_client_body; content:"&ie="; http_client_body; content:"&input="; http_client_body; content:"&c="; http_client_body; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; classtype:trojan-activity; sid:2008443; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2018-01-26 16:33:31 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST"; nocase; http_method; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"r="; http_client_body; content:"&i="; http_client_body; content:"&v="; http_client_body; content:"&os="; http_client_body; content:"&s="; http_client_body; content:"&h="; http_client_body; content:"&d="; http_client_body; content:"&panic"; http_client_body; content:"&ie="; http_client_body; content:"&input="; http_client_body; content:"&c="; http_client_body; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; classtype:trojan-activity; sid:2008443; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-08-07 21:01:37 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST"; nocase; http_method; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"r="; depth:2; http_client_body; content:"&i="; distance:0; content:"&v="; distance:0; content:"&os="; distance:0; content:"&s="; distance:0; content:"&h="; distance:0; content:"&d="; distance:0; content:"&panic"; distance:0; fast_pattern; content:"&ie="; distance:0; content:"&input="; distance:0; content:"&c="; distance:0; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; classtype:trojan-activity; sid:2008443; rev:9;)

Added 2012-03-16 17:32:37 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST"; http_method; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"r="; depth:2; http_client_body; content:"&i="; distance:0; content:"&v="; distance:0; content:"&os="; distance:0; content:"&s="; distance:0; content:"&h="; distance:0; content:"&d="; distance:0; content:"&panic"; distance:0; fast_pattern; content:"&ie="; distance:0; content:"&input="; distance:0; content:"&c="; distance:0; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; classtype:trojan-activity; sid:2008443; rev:8;)

Added 2011-10-12 19:25:09 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST"; http_method; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"r="; depth:2; http_client_body; content:"&i="; distance:0; content:"&v="; distance:0; content:"&os="; distance:0; content:"&s="; distance:0; content:"&h="; distance:0; content:"&d="; distance:0; content:"&panic"; distance:0; fast_pattern; content:"&ie="; distance:0; content:"&input="; distance:0; content:"&c="; distance:0; classtype:trojan-activity; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; sid:2008443; rev:8;)

Added 2011-09-14 22:38:36 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST"; http_method; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"r="; depth:2; http_client_body; content:"&i="; distance:0; content:"&v="; distance:0; content:"&os="; distance:0; content:"&s="; distance:0; content:"&h="; distance:0; content:"&d="; distance:0; content:"&panic"; distance:0; fast_pattern; content:"&ie="; distance:0; content:"&input="; distance:0; content:"&c="; distance:0; classtype:trojan-activity; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Coreflood; sid:2008443; rev:8;)

Added 2011-02-04 17:27:37 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"|0d 0a 0d 0a|r="; content:"&i="; distance:0; content:"&v="; distance:0; content:"&os="; distance:0; content:"&s="; distance:0; content:"&h="; distance:0; content:"&d="; distance:0; content:"&panic"; distance:0; content:"&ie=&"; distance:0; content:"input="; distance:0; content:"&c="; distance:0; classtype:trojan-activity; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Coreflood; sid:2008443; rev:2;)

Added 2009-02-12 18:21:14 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"|0d 0a 0d 0a|r="; content:"&i="; distance:0; content:"&v="; distance:0; content:"&os="; distance:0; content:"&s="; distance:0; content:"&h="; distance:0; content:"&d="; distance:0; content:"&panic"; distance:0; content:"&ie=&"; distance:0; content:"input="; distance:0; content:"&c="; distance:0; classtype:trojan-activity; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008443; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Coreflood; sid:2008443; rev:2;)

Added 2009-02-12 18:21:14 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Coreflood/AFcore Trojan Infection (2)"; flow:to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|Host|3a 20|"; content:"|0d 0a 0d 0a|r="; content:"&i="; distance:0; content:"&v="; distance:0; content:"&os="; distance:0; content:"&s="; distance:0; content:"&h="; distance:0; content:"&d="; distance:0; content:"&panic"; distance:0; content:"&ie=&"; distance:0; content:"input="; distance:0; content:"&c="; distance:0; classtype:trojan-activity; reference:url,www.secureworks.com/research/threats/coreflood; sid:2008443; rev:1;)

Added 2008-07-18 11:38:50 UTC