alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.BAT.Qhost - SET"; flow:established,to_server; content:"GET "; depth:4; content:"/stat/tuk/"; within:10; flowbits:set,ETPRO.Trojan.BAT.Qhost; flowbits:noalert; reference:md5,f6e1583aca310c4c0d55db1dae942b2b; classtype:trojan-activity; sid:2014758; rev:4;)

Added 2014-04-14 19:22:50 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Trojan.BAT.Qhost - SET"; flow:established,to_server; content:"GET "; depth:4; content:"/stat/tuk/"; within:10; flowbits:set,ETPRO.Trojan.BAT.Qhost; flowbits:noalert; reference:md5,8174d42fd82457592c573fe73bdc0cd5; classtype:trojan-activity; sid:2014758; rev:3;)

Added 2012-05-17 22:00:09 UTC


Topic revision: r1 - 2014-04-14 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats