2012221 < Main < EmergingThreats

Main Web>2012221 (2020-10-19, TWikiGuest) (raw view)
 <h2>
 

#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Malware Related msndown"; flow:established,to_server; content:"msndown"; http_user_agent; depth:7; isdataat:!1,relative; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; classtype:trojan-activity; sid:2012221; rev:4; metadata:created_at 2011_01_22, former_category USER_AGENTS, updated_at 2020_10_19;)

</h2>

Added 2020-10-19 19:37:47 UTC


 %COMMENT{type="threadmode" default="Please enter documentation, comments, false positives, or concerns with this signature. Press the Attach button below to add samples or Pcaps." button="Add to Documentation" }%
 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Malware Related msndown"; flow:established,to_server; content:"msndown"; http_user_agent; depth:7; isdataat:!1,relative; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; classtype:trojan-activity; sid:2012221; rev:4; metadata:created_at 2011_01_22, former_category USER_AGENTS, updated_at 2019_10_11;)

</h2>

Added 2020-08-05 19:06:58 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Malware Related msndown"; flow:established,to_server; content:"msndown"; http_user_agent; depth:7; isdataat:!1,relative; metadata: former_category USER_AGENTS; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; classtype:trojan-activity; sid:2012221; rev:4; metadata:created_at 2011_01_22, updated_at 2019_10_11;)

</h2>

Added 2019-10-11 19:56:33 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Malware Related msndown"; flow:established,to_server; content:"User-Agent|3a| msndown|0d 0a|"; http_header; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; classtype:trojan-activity; sid:2012221; rev:3; metadata:created_at 2011_01_22, updated_at 2019_09_27;)

</h2>

Added 2019-09-27 18:53:46 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Malware Related msndown"; flow:established,to_server; content:"User-Agent|3a| msndown|0d 0a|"; http_header; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; classtype:trojan-activity; sid:2012221; rev:2; metadata:created_at 2011_01_22, updated_at 2011_01_22;)

</h2>

Added 2018-09-13 19:42:29 UTC


 
 <hr>
 


 <h2>
 


</h2>

Added 2018-09-13 17:55:15 UTC


 
 <hr>
 


 <h2>
 

alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Malware Related msndown"; flow:established,to_server; content:"User-Agent|3a| msndown|0d 0a|"; http_header; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; classtype:trojan-activity; sid:2012221; rev:2; metadata:created_at 2011_01_22, updated_at 2011_01_22;)

</h2>

Added 2017-08-07 21:05:20 UTC


 
 <hr>
 


 <h2>
 

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Malware Related msndown"; flow:established,to_server; content:"User-Agent|3a| msndown|0d 0a|"; http_header; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; classtype:trojan-activity; sid:2012221; rev:1;)

</h2>

Added 2011-10-12 19:33:44 UTC


 
 <hr>
 


 <h2>
 

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Malware Related msndown"; flow:established,to_server; content:"User-Agent|3a| msndown|0d 0a|"; http_header; classtype:trojan-activity; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=17fdf0cb5970b71b81b1a5406e017ac1; sid:2012221; rev:1;)

</h2>

Added 2011-02-04 17:32:08 UTC


 
 <hr>
Topic revision: r1 - 2020-10-19 - TWikiGuest
Main
User Reference
ATasteOfTWiki
TextFormattingRules
Signature Reference
WebRss Feed
EmergingFAQ