alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (iran_occupation.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/iran_occupation.exe"; reference:url,www.sudosecure.net/archives/146; reference:url,www.us-cert.gov/current/index.html#new_storm_worm_varient_spreading; classtype:trojan-activity; sid:2008288; rev:6;)

Added 2008-07-11 10:00:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (iran_occupation.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/iran_occupation.exe"; reference:url,www.sudosecure.net/archives/146; reference:url,www.us-cert.gov/current/index.html#new_storm_worm_varient_spreading; classtype:trojan-activity; sid:2008288; rev:6;)

Added 2008-07-11 10:00:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (iran_occupation.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/iran_occupation.exe"; reference:url,www.sudosecure.net/archives/146; classtype:trojan-activity; sid:2008288; rev:5;)

Added 2008-07-08 23:25:29 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (iran_occupation.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/iran_occupation.exe"; reference:url,www.sudosecure.net/archives/146; classtype:trojan-activity; sid:2008288; rev:5;)

Added 2008-07-08 23:25:29 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (mylove.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"mylove.exe"; classtype:trojan-activity; sid:2008288; rev:3;)

Added 2008-07-01 14:48:32 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (mylove.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"mylove.exe"; classtype:trojan-activity; sid:2008288; rev:3;)

Added 2008-07-01 14:48:32 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (video.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"video.exe"; classtype:trojan-activity; sid:2008288; rev:2;)

Added 2008-06-23 16:58:07 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm URL Request (video.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"video.exe"; classtype:trojan-activity; sid:2008288; rev:2;)

Added 2008-06-23 16:58:07 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Storm Worm URL Request (video.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"video.exe"; classtype:trojan-activity; sid:2008288; rev:1;)

Added 2008-06-20 08:07:07 UTC