alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HB_Banker16 Get"; flow:to_server,established; content:"GET"; http_method; content:"Content-Type|3a 20|text/html|0d 0a|Host|3a|"; http_header; depth:30; fast_pattern; content:!"Indy Library"; http_header; content:"Firefox/12.0"; http_user_agent; http_header_names; content:"|0d 0a|Content-Type|0d 0a|Host|0d 0a|Accept|0d 0a|User-Agent|0d 0a 0d 0a|"; depth:44; isdataat:!1,relative; classtype:trojan-activity; sid:2019608; rev:5; metadata:created_at 2014_10_30, updated_at 2020_02_07;)

Added 2020-02-07 19:49:53 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HB_Banker16 Get"; flow:to_server,established; content:"GET"; http_method; content:"Content-Type|3a 20|text/html|0d 0a|Host|3a|"; http_header; depth:30; fast_pattern:10,20; content:!"Referer|3a|"; content:!"Accept-"; http_header; content:!"Indy Library"; http_header; content:"Firefox/12.0"; http_user_agent; pcre:"/^Content-Type\x3a\x20text\/html\r\nHost\x3a\x20[^\r\n]+?\r\nAccept\x3a\x20text\/html,\x20\*\/\*\r\nUser-Agent\x3a\x20[^\r\n]+?\r\n(?:\r\n)?$/H"; classtype:trojan-activity; sid:2019608; rev:4; metadata:created_at 2014_10_30, updated_at 2014_10_30;)

Added 2018-09-13 19:49:42 UTC


Added 2018-09-13 17:59:14 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HB_Banker16 Get"; flow:to_server,established; content:"GET"; http_method; content:"Content-Type|3a 20|text/html|0d 0a|Host|3a|"; http_header; depth:30; fast_pattern:10,20; content:!"Referer|3a|"; content:!"Accept-"; http_header; content:!"Indy Library"; http_header; content:"Firefox/12.0"; http_user_agent; pcre:"/^Content-Type\x3a\x20text\/html\r\nHost\x3a\x20[^\r\n]+?\r\nAccept\x3a\x20text\/html,\x20\*\/\*\r\nUser-Agent\x3a\x20[^\r\n]+?\r\n(?:\r\n)?$/H"; classtype:trojan-activity; sid:2019608; rev:4; metadata:created_at 2014_10_30, updated_at 2014_10_30;)

Added 2017-08-07 21:13:53 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN HB_Banker16 Get"; flow:to_server,established; content:"GET"; http_method; content:"Content-Type|3a 20|text/html|0d 0a|Host|3a|"; http_header; depth:30; fast_pattern:10,20; content:!"Referer|3a|"; content:!"Accept-"; http_header; content:!"Indy Library"; http_header; content:"Firefox/12.0"; http_user_agent; pcre:"/^Content-Type\x3a\x20text\/html\r\nHost\x3a\x20[^\r\n]+?\r\nAccept\x3a\x20text\/html,\x20\*\/\*\r\nUser-Agent\x3a\x20[^\r\n]+?\r\n(?:\r\n)?$/H"; classtype:trojan-activity; sid:2019608; rev:4;)

Added 2014-10-30 17:27:53 UTC


Topic revision: r1 - 2020-02-08 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats