#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST"; depth:4; http_method; content:!"User-Agent|3a| "; http_header; content:"Content-Length|3a| 0|0d 0a|"; http_header; content:"Connection|3a| close|0d 0a|"; http_header; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/U"; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,offensivecomputing.net/?q=node/909; classtype:trojan-activity; sid:2008660; rev:8;)

Added 2014-08-26 19:07:49 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST"; depth:4; http_method; content:!"User-Agent|3a| "; http_header; content:"Content-Length|3a| 0|0d 0a|"; http_header; content:"Connection|3a| close|0d 0a|"; http_header; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/U"; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,offensivecomputing.net/?q=node/909; classtype:trojan-activity; sid:2008660; rev:7;)

Added 2011-10-12 19:25:33 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST"; depth:4; http_method; content:!"User-Agent|3a| "; http_header; content:"Content-Length|3a| 0|0d 0a|"; http_header; content:"Connection|3a| close|0d 0a|"; http_header; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/U"; classtype:trojan-activity; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,offensivecomputing.net/?q=node/909; sid:2008660; rev:7;)

Added 2011-09-14 22:39:00 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST"; depth:4; http_method; content:!"User-Agent|3a| "; http_header; content:"Content-Length|3a| 0|0d 0a|"; http_header; content:"Connection|3a| close|0d 0a|"; http_header; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/U"; classtype:trojan-activity; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,offensivecomputing.net/?q=node/909; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2008660; rev:7;)

Added 2011-02-04 17:27:51 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST "; depth:5; content:!"|0d 0a|User-Agent\: "; content:"|0d 0a|Content-Length\: 0|0d 0a|"; content:"|0d 0a|Connection\: close|0d 0a|"; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/U"; classtype:trojan-activity; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,offensivecomputing.net/?q=node/909; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2008660; rev:6;)

Added 2010-01-29 11:39:57 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST "; depth:5; content:!"|0d 0a|User-Agent\: "; content:"|0d 0a|Content-Length\: 0|0d 0a|"; content:"|0d 0a|Connection\: close|0d 0a|"; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/U"; classtype:trojan-activity; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,offensivecomputing.net/?q=node/909; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2008660; rev:6;)

Added 2010-01-29 11:39:57 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|"; content:!"|0d 0a|User-Agent\: "; content:"|0d 0a|Content-Length\: 0|0d 0a|"; content:"|0d 0a|Connection\: close|0d 0a|"; classtype:trojan-activity; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2008660; rev:5;)

Added 2010-01-27 12:57:41 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|"; content:!"_Tunnel-Request|3a| "; nocase; content:!"|0d 0a|User-Agent|3a| "; content:"|0d 0a|Content-Length|3a| 0|0d 0a|"; content:"|0d 0a|Connection|3a| close|0d 0a|"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2008660; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2008660; rev:4;)

Added 2009-08-25 20:15:36 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|"; content:!"_Tunnel-Request|3a| "; nocase; content:!"|0d 0a|User-Agent|3a| "; content:"|0d 0a|Content-Length|3a| 0|0d 0a|"; content:"|0d 0a|Connection|3a| close|0d 0a|"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2008660; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2008660; rev:4;)

Added 2009-08-25 20:15:36 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|"; content:!"|0d 0a|User-Agent\: "; content:"|0d 0a|Content-Length\: 0|0d 0a|"; content:"|0d 0a|Connection\: close|0d 0a|"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2008660; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2008660; rev:2;)

Added 2009-02-13 19:47:26 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Infection Reporting"; flow:established,to_server; content:"POST "; depth:5; content:"HTTP/1.0|0d 0a|"; content:!"|0d 0a|User-Agent\: "; content:"|0d 0a|Content-Length\: 0|0d 0a|"; content:"|0d 0a|Connection\: close|0d 0a|"; classtype:trojan-activity; sid:2008660; rev:1;)

Added 2008-10-13 12:30:23 UTC


Topic revision: r2 - 2009-04-30 - MattJonkman
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats