alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WARP Win32/Barkiofork.A"; flow:established,to_server; content:"/s/asp?"; http_uri; fast_pattern; pcre:"/p=1$/U"; content:"Mozilla/4.0 (compatible|3b 20|)"; http_user_agent; depth:26; isdataat:!1,relative; reference:url,www.mandiant.com/apt1; reference:md5,7acb0d1df51706536f33bbdb990041d3; classtype:trojan-activity; sid:2016447; rev:3; metadata:created_at 2013_02_20, updated_at 2019_10_11;)

Added 2019-10-11 19:56:37 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WARP Win32/Barkiofork.A"; flow:established,to_server; content:"/s/asp?"; http_uri; fast_pattern; pcre:"/p=1$/U"; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| )|0d 0a|"; http_header; reference:url,www.mandiant.com/apt1; reference:md5,7acb0d1df51706536f33bbdb990041d3; classtype:trojan-activity; sid:2016447; rev:2; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2018-09-13 19:46:25 UTC

Added 2018-09-13 17:57:21 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN WARP Win32/Barkiofork.A"; flow:established,to_server; content:"/s/asp?"; http_uri; fast_pattern; pcre:"/p=1$/U"; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| )|0d 0a|"; http_header; reference:url,www.mandiant.com/apt1; reference:md5,7acb0d1df51706536f33bbdb990041d3; classtype:trojan-activity; sid:2016447; rev:2; metadata:created_at 2013_02_20, updated_at 2013_02_20;)

Added 2017-08-07 21:10:10 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN WARP Win32/Barkiofork.A"; flow:established,to_server; content:"/s/asp?"; http_uri; fast_pattern; pcre:"/p=1$/U"; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| )|0d 0a|"; http_header; reference:url,www.mandiant.com/apt1; reference:md5,7acb0d1df51706536f33bbdb990041d3; classtype:trojan-activity; sid:2016447; rev:1;)

Added 2013-02-20 05:32:08 UTC