alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Adware.Adposhel.A Checkin 3"; flow:established,to_server; content:"HEAD"; http_method; content:"/u/?"; depth:4; http_uri; fast_pattern; content:"&c="; http_uri; distance:0; content:"&r="; http_uri; distance:0; pcre:"/^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$/U"; reference:url,blog.malwarebytes.org/cybercrime/2016/01/trojan-dnschanger-circumvents-powershell-restrictions/; classtype:trojan-activity; sid:2022722; rev:2; metadata:created_at 2016_04_11, updated_at 2016_04_11;)

Added 2018-09-13 19:52:29 UTC


Added 2018-09-13 18:00:52 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Adware.Adposhel.A Checkin 3"; flow:established,to_server; content:"HEAD"; http_method; content:"/u/?"; depth:4; http_uri; fast_pattern; content:"&c="; http_uri; distance:0; content:"&r="; http_uri; distance:0; pcre:"/^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$/U"; reference:url,blog.malwarebytes.org/cybercrime/2016/01/trojan-dnschanger-circumvents-powershell-restrictions/; classtype:trojan-activity; sid:2022722; rev:2; metadata:created_at 2016_04_11, updated_at 2016_04_11;)

Added 2017-08-07 21:17:41 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Adware.Adposhel.A Checkin 3"; flow:established,to_server; content:"HEAD"; http_method; content:"/u/?"; depth:4; http_uri; fast_pattern; content:"&c="; http_uri; distance:0; content:"&r="; http_uri; distance:0; pcre:"/^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$/U"; reference:url,blog.malwarebytes.org/cybercrime/2016/01/trojan-dnschanger-circumvents-powershell-restrictions/; classtype:trojan-activity; sid:2022722; rev:2;)

Added 2016-04-12 12:06:20 UTC


Topic revision: r1 - 2018-09-13 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats