Versions (2)
Version DetailsCurrent
Rev: 11 • Jul 30, 2010, 12:00 PMET MALWARE Suspicious User Agent Detected (RookIE) - Common with Downloaders
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent Detected (RookIE) - Common with Downloaders"; flow:established,to_server; http.user_agent; content:"RookIE"; depth:6; http.host; content:!"www.ugee.com.cn"; classtype:trojan-activity; sid:2003635; rev:11; metadata:attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, confidence Medium, signature_severity Major, updated_at 2023_05_17; target:src_ip;)
Jul 30, 2010, 12:00 PM
May 17, 2023, 12:00 PM
Jul 30, 2010, 12:00 PM
May 31, 2024, 9:00 PM
rules/emerging-malware.rules