alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; sid: 2000026; rev:30;)

Added 2008-05-09 17:01:40 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; content:" Gator"; nocase; within:150; pcre:"/User-Agent\:[^\n]+Gator/i"; classtype: policy-violation; sid: 2000026; rev:30;)

Added 2008-05-09 17:01:40 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; content:!"User-Agent\: FeedDemon?"; classtype: policy-violation; sid: 2000026; rev:29;)

Added 2008-04-04 09:27:26 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; content:!"User-Agent\: FeedDemon?"; classtype: policy-violation; sid: 2000026; rev:29;)

Added 2008-04-04 09:27:26 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:28;)

Added 2008-02-01 14:32:22 UTC

User-agent 'FeedDemon/2.6 (http://www.newsgator.com/; Microsoft Windows XP)' gives false positives

-- UveLokk - 04 Apr 2008

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:28;)

Added 2008-02-01 14:32:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:18;)

Added 2008-01-28 17:24:20 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:18;)

Added 2008-01-28 17:24:20 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:17;)

Added 2007-09-05 12:33:03 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; content:!"navigator"; nocase; classtype: policy-violation; sid: 2000026; rev:17;)

Added 2007-09-05 12:33:03 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Navigator/"; content:!"Aventail Interrogator"; classtype: policy-violation; sid: 2000026; rev:16;)

Added 2007-07-04 08:31:46 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE Malware Gator Agent Traffic"; flow: to_server,established; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+Gator/i"; content:!"User-Agent\: Akregator"; content:!"Aventail Interrogator"; classtype: policy-violation; sid: 2000026; rev:15;)