alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:11; metadata:created_at 2013_11_21, former_category MALWARE, updated_at 2020_09_24;)

Added 2021-02-18 18:18:42 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:11; metadata:created_at 2013_11_21, former_category MALWARE, updated_at 2020_09_24;)

Added 2020-09-24 18:40:45 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:11; metadata:created_at 2013_11_21, former_category MALWARE, updated_at 2019_10_07;)

Added 2020-08-05 19:09:53 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern:only; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; metadata: former_category MALWARE; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:10; metadata:created_at 2013_11_21, updated_at 2019_10_07;)

Added 2019-10-07 19:58:45 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern:only; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; metadata: former_category MALWARE; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:10; metadata:created_at 2013_11_21, updated_at 2013_11_21;)

Added 2019-09-26 19:57:39 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern:only; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:10; metadata:created_at 2013_11_21, updated_at 2013_11_21;)

Added 2018-09-13 19:48:53 UTC


Added 2018-09-13 17:58:44 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern:only; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:10; metadata:created_at 2013_11_21, updated_at 2013_11_21;)

Added 2017-08-07 21:12:40 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Miuref/Boaxxe Checkin"; flow:to_server,established; content:"GET"; http_method; urilen:>400; content:"%2b"; fast_pattern:only; http_raw_uri; content:"%2f"; http_raw_uri; content:!"Referer|3a|"; http_header; content:!"|2e|"; http_raw_uri; content:!"|3f|"; http_raw_uri; content:!"|26|"; http_raw_uri; pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/I"; reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/; reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx; classtype:trojan-activity; sid:2018582; rev:10;)

Added 2014-06-19 18:11:42 UTC


Topic revision: r1 - 2021-02-18 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats