alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; http_start; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:5; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2020_11_05;)

Added 2020-11-05 18:35:54 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; http_start; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:5; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2020_03_09;)

Added 2020-08-05 19:08:51 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; http_start; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern; metadata: former_category MALWARE; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:5; metadata:created_at 2013_02_20, updated_at 2020_03_09;)

Added 2020-03-09 21:02:07 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern:only; content:"CAQGBgoFD1Y"; http_cookie; depth:11; metadata: former_category MALWARE; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:3; metadata:created_at 2013_02_20, updated_at 2019_10_07;)

Added 2019-10-07 19:58:29 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern:only; content:"CAQGBgoFD1Y"; http_cookie; depth:11; metadata: former_category MALWARE; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2019-09-26 19:57:19 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern:only; content:"CAQGBgoFD1Y"; http_cookie; depth:11; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2018-09-13 19:46:24 UTC

Added 2018-09-13 17:57:20 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern:only; content:"CAQGBgoFD1Y"; http_cookie; depth:11; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:3; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2017-08-07 21:10:09 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Win32/COOKIEBAG Cookie APT1 Related"; flow:established,to_server; content:"|0a|Cookie|3a 20|CAQGBgoFD1Y"; fast_pattern:only; content:"CAQGBgoFD1Y"; http_cookie; depth:11; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016434; rev:2;)

Added 2013-02-20 05:32:07 UTC