Rule History

alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE PWS Banker Trojan Sending Report of Infection"; flow: established,to_server; content:"From|3a 20 22|PC ID|3a|"; nocase; content:"Subject|3a| INFECTED"; nocase; content:"esta infectado"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pwsteal.banker.b.html; classtype:trojan-activity; sid:2001933; rev:10; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2019_07_26;)