alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible MSIE 7.0 na .NET CLR 2.0.50727 .NET CLR 3.0.4506.2152 .NET CLR 3.5.30729))"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| na|3b| .NET CLR 2.0.50727|3b| .NET CLR 3.0.4506.2152|3b| .NET CLR 3.5.30729)|0d0a|"; fast_pattern:37,13; http_header; reference:url,www.cyber-ta.org/releases/malware-analysis/public/2009-07-12-public/ARCHIVE/1247423556.chatter; reference:url,doc.emergingthreats.net/2009810; classtype:trojan-activity; sid:2009810; rev:6;)

Added 2011-12-19 18:45:34 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible MSIE 7.0 na .NET CLR 2.0.50727 .NET CLR 3.0.4506.2152 .NET CLR 3.5.30729))"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| na|3b| .NET CLR 2.0.50727|3b| .NET CLR 3.0.4506.2152|3b| .NET CLR 3.5.30729)|0d0a|"; http_header; reference:url,www.cyber-ta.org/releases/malware-analysis/public/2009-07-12-public/ARCHIVE/1247423556.chatter; reference:url,doc.emergingthreats.net/2009810; classtype:trojan-activity; sid:2009810; rev:5;)

Added 2011-10-12 19:28:18 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible MSIE 7.0 na .NET CLR 2.0.50727 .NET CLR 3.0.4506.2152 .NET CLR 3.5.30729))"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| na|3b| .NET CLR 2.0.50727|3b| .NET CLR 3.0.4506.2152|3b| .NET CLR 3.5.30729)|0d0a|"; http_header; classtype:trojan-activity; reference:url,www.cyber-ta.org/releases/malware-analysis/public/2009-07-12-public/ARCHIVE/1247423556.chatter; reference:url,doc.emergingthreats.net/2009810; sid:2009810; rev:5;)

Added 2011-09-14 22:41:36 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible MSIE 7.0 na .NET CLR 2.0.50727 .NET CLR 3.0.4506.2152 .NET CLR 3.5.30729))"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| na|3b| .NET CLR 2.0.50727|3b| .NET CLR 3.0.4506.2152|3b| .NET CLR 3.5.30729)|0d0a|"; http_header; classtype:trojan-activity; reference:url,www.cyber-ta.org/releases/malware-analysis/public/2009-07-12-public/ARCHIVE/1247423556.chatter; reference:url,doc.emergingthreats.net/2009810; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Lop; sid:2009810; rev:5;)

Added 2011-02-04 17:29:12 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible\; MSIE 7.0\; na\; .NET CLR 2.0.50727\; .NET CLR 3.0.4506.2152\; .NET CLR 3.5.30729))"; flow:established,to_server; content:"GET "; depth:4; content:"|0d0a|User-Agent\: Mozilla/4.0 (compatible\; MSIE 7.0\; na\; .NET CLR 2.0.50727\; .NET CLR 3.0.4506.2152\; .NET CLR 3.5.30729)|0d0a|"; within:500; reference:url,www.cyber-ta.org/releases/malware-analysis/public/2009-07-12-public/ARCHIVE/1247423556.chatter; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009810; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Lop; sid:2009810; rev:2;)

Added 2009-08-31 16:38:43 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible\; MSIE 7.0\; na\; .NET CLR 2.0.50727\; .NET CLR 3.0.4506.2152\; .NET CLR 3.5.30729))"; flow:established,to_server; content:"GET "; depth:4; content:"|0d0a|User-Agent\: Mozilla/4.0 (compatible\; MSIE 7.0\; na\; .NET CLR 2.0.50727\; .NET CLR 3.0.4506.2152\; .NET CLR 3.5.30729)|0d0a|"; within:500; reference:url,www.cyber-ta.org/releases/malware-analysis/public/2009-07-12-public/ARCHIVE/1247423556.chatter; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009810; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Lop; sid:2009810; rev:2;)

Added 2009-08-31 16:38:43 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Swizzor-based Downloader - Invalid User-Agent (Mozilla/4.0 (compatible\; MSIE 7.0\; na\; .NET CLR 2.0.50727\; .NET CLR 3.0.4506.2152\; .NET CLR 3.5.30729))"; flow:established,to_server; content:"GET "; depth:4; content:"|0d0a|User-Agent\: Mozilla/4.0 (compatible\; MSIE 7.0\; na\; .NET CLR 2.0.50727\; .NET CLR 3.0.4506.2152\; .NET CLR 3.5.30729)|0d0a|"; within:500; reference:url,www.cyber-ta.org/releases/malware-analysis/public/2009-07-12-public/ARCHIVE/1247423556.chatter; classtype:trojan-activity; sid:2009810; rev:1;)

Added 2009-08-31 10:30:39 UTC