#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:<20; content:"PONG |3a|"; depth:6; reference:url,doc.emergingthreats.net/2010824; classtype:trojan-activity; sid:2010824; rev:4;)

Added 2011-10-21 14:51:00 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:<20; content:"PONG |3a|"; depth:6; reference:url,doc.emergingthreats.net/2010824; classtype:trojan-activity; sid:2010824; rev:4;)

Added 2011-10-20 15:10:33 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; reference:url,doc.emergingthreats.net/2010824; classtype:trojan-activity; sid:2010824; rev:3;)

Added 2011-10-12 19:30:41 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010824; sid:2010824; rev:3;)

Added 2011-09-14 22:43:50 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010824; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2010824; rev:3;)

Added 2011-02-04 17:30:29 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010824; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2010824; rev:3;)

Added 2010-06-09 20:41:08 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010824; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2010824; rev:3;)

Added 2010-06-09 20:41:08 UTC

alert tcp $HOME_NET 1024: -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010824; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2010824; rev:2;)

Added 2010-02-23 10:55:59 UTC

alert tcp $HOME_NET 1024: -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2010824; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Torpig; sid:2010824; rev:2;)

Added 2010-02-23 10:55:59 UTC

alert tcp $HOME_NET 1024: -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:9; content:"PONG |3a|"; depth:6; nocase; classtype:trojan-activity; sid:2010824; rev:1;)

Added 2010-02-19 11:22:58 UTC