Web Search

alert http $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:`ET ATTACK RESPONSE Windows LMHosts File Download Likely DNSChanger Infection`; flow:established,to client ...

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:`ET CURRENT EVENTS Mac DNS Changer Trojan UA Detected`; flow:established,to server; uricontent:`cgi bin/generator ...

alert http $HOME NET any $EXTERNAL NET any (msg:`ET TROJAN DNSChanger.AT or related Infection Checkin Post`; flow:established,to server; content:`POST /cgi bin ...

alert http $HOME NET any $EXTERNAL NET any (msg:`ET TROJAN Fasec/FakeAV Alert/Keylogger/Dropper/DNSChanger Possible Rootkit HTTP GET`; flow:established,to server ...

alert http $HOME NET any $EXTERNAL NET any (msg:`ET TROJAN MyDNS DNSChanger HTTP POST`; flow:established,to server; content:`POST`; nocase; http method; content ...

#alert udp !$DNS SERVERS any 85.255.112.0/20,67.210.0.0/20,93.188.160.0/21,77.67.83.0/24,213.109.64.0/20,64.28.176.0/20 53 (msg:`ET DELETED Ghost Click DNSChanger ...

#alert udp $HOME NET any 85.255.112.0/20,67.210.0.0/20,93.188.160.0/21,77.67.83.0/24,213.109.64.0/20,64.28.176.0/20 53 (msg:`ET DELETED Potential DNS Request ...

alert http $HOME NET any $EXTERNAL NET any (msg:`ET TROJAN W32/Dadobra.Downloader/DNSChanger Dnsmake CnC Beacon`; flow:established,to server; content:`/dnsmake ...

alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS WebRTC IP tracker Observed in DNSChanger EK May 12 2015`; flow:established,from server; file ...

alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS DNSChanger EK Landing May 12 2015`; flow:established,from server; file data; content:``; nocase ...

alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS DNSChanger EK Secondary Landing May 12 2015 M2`; flow:established,from server; file data; content ...

alert http $HOME NET any $EXTERNAL NET any (msg:`ET CURRENT EVENTS DNSChanger EK Landing URI Struct May 22 2015`; flow:to server,established; content:`/stat/load ...

alert http $HOME NET any $EXTERNAL NET any (msg:`ET MALWARE Win32/Adware.Adposhel.A Checkin 3`; flow:established,to server; content:`HEAD`; http method; content ...

alert http $EXTERNAL NET any $HOME NET any (msg:`ET CURRENT EVENTS DNSChanger EK Secondary Landing Oct 31 2016`; flow:established,from server; file data; content ...

alert http any any $HOME NET any (msg:`ET EXPLOIT TP LINK DNS Change GET Request (DNSChanger EK)`; flow:to server,established; content:`GET`; http method; content ...

alert tcp any any $HOME NET $HTTP PORTS (msg:`ET EXPLOIT TP LINK Password Change GET Request (DNSChanger EK)`; flow:to server,established; content:`GET`; http method ...