alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; classtype:trojan-activity; sid:2008027; rev:2;)

Added 2008-06-24 23:26:43 UTC

alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; classtype:trojan-activity; sid:2008027; rev:2;)

Added 2008-06-24 23:26:43 UTC

alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; classtype:trojan-activity; sid:2008027; rev:2;)

Added 2008-06-24 23:24:11 UTC

alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET TROJAN Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; classtype:trojan-activity; sid:2008027; rev:2;)

Added 2008-06-24 23:24:11 UTC

alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 1024: (msg:"ET TROJAN Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; classtype:trojan-activity; sid:2008027; rev:1;)

Added 2008-03-19 09:09:29 UTC

See Win32Turkojan

-- MattJonkman - 19 Mar 2008

alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 1024: (msg:"ET TROJAN Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; classtype:trojan-activity; sid:2008027; rev:1;)

Added 2008-03-19 09:07:44 UTC