alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Observed Malicious SSL Cert (BrushaLoader? CnC?)"; flow:established,from_server; content:"traderserviceinfo.info"; fast_pattern; tls_cert_issuer; content:"C=AU, ST=Some-State, L=City, O=Some|20|Company"; metadata: former_category TROJAN; classtype:trojan-activity; sid:2026899; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, tag SSL_Malicious_Cert, created_at 2019_02_12, malware_family BrushaLoader?, updated_at 2019_02_12;)

Added 2019-02-12 17:05:39 UTC