alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:`ET CURRENT EVENTS Mac DNS Changer Trojan UA Detected`; flow:established,to server; uricontent:`cgi bin/generator ...
#alert http $HOME NET any $EXTERNAL NET any (msg:`ET TROJAN DNSChanger.AT or related Infection Checkin Post`; flow:established,to server; content:`POST /cgi bin ...
alert http $HOME NET any $EXTERNAL NET any (msg:`ET TROJAN Fasec/FakeAV Alert/Keylogger/Dropper/DNSChanger Possible Rootkit HTTP GET`; flow:established,to server ...
#alert udp $HOME NET any 85.255.112.0/20,67.210.0.0/20,93.188.160.0/21,77.67.83.0/24,213.109.64.0/20,64.28.176.0/20 53 (msg:`ET DELETED Potential DNS Request ...
alert http $HOME NET any $EXTERNAL NET any (msg:`ET TROJAN W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon`; flow:established,to server; content:`/dnsmake ...
alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS WebRTC IP tracker Observed in DNSChanger EK May 12 2015`; flow:established,from server; file ...
alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS DNSChanger EK Landing May 12 2015`; flow:established,from server; file data; content:``; nocase ...
alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS DNSChanger EK Secondary Landing May 12 2015 M2`; flow:established,from server; file data; content ...
alert http $HOME NET any $EXTERNAL NET any (msg:`ET CURRENT EVENTS DNSChanger EK Landing URI Struct May 22 2015`; flow:to server,established; content:`/stat/load ...
alert http $HOME NET any $EXTERNAL NET any (msg:`ET MALWARE Win32/Adware.Adposhel.A Checkin 3`; flow:established,to server; content:`HEAD`; http method; content ...
alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS DNSChanger EK Secondary Landing Oct 31 2016`; flow:established,from server; file data; content ...
alert http any any $HOME NET any (msg:`ET EXPLOIT TP LINK DNS Change GET Request (DNSChanger EK)`; flow:to server,established; content:`GET`; http method; content ...
alert tcp any any $HOME NET $HTTP PORTS (msg:`ET EXPLOIT TP LINK Password Change GET Request (DNSChanger EK)`; flow:to server,established; content:`GET`; http method ...
Number of topics: 16
Other search options:
If you already know the name of the topic, enter the name of the topic into the Jump box at the top