alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32/Wombot.A checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST"; http_method; content:"&ver="; http_client_body; content:"&MAX_EXECUTE_TIME="; http_client_body; fast_pattern; content:"&RELOAD_JOBS="; http_client_body; content:"&BROWSER_DELAY="; http_client_body; content:"&CONTROL_PAGE"; http_client_body; content:"&lastlogcount"; http_client_body; content:"&min_captchasize"; http_client_body; content:"&botid"; http_client_body; content:"&REG_NAME"; http_client_body; content:"&botlogin="; http_client_body; reference:url,doc.emergingthreats.net/2009830; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FWombot.A; classtype:trojan-activity; sid:2009830; rev:7;)

Added 2012-01-27 00:25:14 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST"; http_method; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; fast_pattern; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; reference:url,doc.emergingthreats.net/2009830; classtype:trojan-activity; sid:2009830; rev:4;)

Added 2011-10-12 19:28:21 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST"; http_method; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; fast_pattern; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009830; sid:2009830; rev:4;)

Added 2011-09-14 22:41:39 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST"; http_method; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; fast_pattern; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009830; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Unknown; sid:2009830; rev:4;)

Added 2011-02-04 17:29:13 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST "; depth:5; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009830; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Unknown; sid:2009830; rev:2;)

Added 2009-09-08 16:48:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST "; depth:5; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009830; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Unknown; sid:2009830; rev:2;)

Added 2009-09-08 16:48:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST "; depth:5; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009830; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Unknown; sid:2009830; rev:2;)

Added 2009-09-08 16:45:37 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST "; depth:5; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009830; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Unknown; sid:2009830; rev:2;)

Added 2009-09-08 16:45:37 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Web Bot checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST "; depth:5; content:"&ver="; nocase; content:"&MAX_EXECUTE_TIME="; nocase; content:"&RELOAD_JOBS="; nocase; content:"&BROWSER_DELAY="; nocase; content:"&CONTROL_PAGE"; nocase; content:"&lastlogcount"; nocase; content:"&min_captchasize"; nocase; content:"&REPORTS_PAGE"; nocase; content:"&TICKETS_PAGE"; nocase; content:"&botid"; nocase; content:"&REG_NAME"; nocase; content:"&botlogin="; nocase; classtype:trojan-activity; sid:2009830; rev:1;)

Added 2009-09-01 10:23:42 UTC