Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zango-Hotbar User-Agent (zbu-hb-)"; flow:to_server,established; content:"zbu-hb-"; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+zbu-hb-/Hi"; classtype:trojan-activity; sid:2003305; rev:10; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)