alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; content:" MSIE "; http_user_agent; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a 0d 0a|"; fast_pattern; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Referer"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:4; metadata:created_at 2013_07_31, updated_at 2019_05_29;)

Added 2019-05-29 19:52:18 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:3; metadata:created_at 2013_07_31, updated_at 2013_07_31;)

Added 2018-09-13 19:47:27 UTC

Added 2018-09-13 17:57:55 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:3; metadata:created_at 2013_07_31, updated_at 2013_07_31;)

Added 2017-08-07 21:11:08 UTC

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN SmokeLoader? Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:3;)

Added 2015-02-02 18:00:26 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN TrojanDownloader?.Win32/Dofoil.U Trojan Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application\/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:2;)

Added 2014-04-21 19:36:52 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN TrojanDownloader?.Win32/Dofoil.U Trojan Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:1;)

Added 2013-08-09 00:04:07 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Trojan Checkin"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; nocase; fast_pattern:only; content:!"Referer|3a|"; http_header; content:"User-Agent|3a|"; depth:11; http_header; pcre:"/^User-Agent\x3a[^\r\n]+?\bMSIE\b/Hi"; pcre:"/application/x-www-form-urlencoded\r\n(\r\n)?$/Hi"; pcre:"/^\d+$/P"; classtype:trojan-activity; sid:2017261; rev:1;)

Added 2013-07-31 18:43:51 UTC