Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon.AZG Checkin"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"eve="; nocase; content:"username="; nocase; content:"anma="; fast_pattern; nocase; content:"ver="; nocase; http.user_agent; bsize:38; content:"Mozilla/3.0 (compatible|3b| Indy Library)"; nocase; reference:url,www.pandasecurity.com/homeusers/security-info/about-malware/encyclopedia/overview.aspx?idvirus=143511&sind=0; reference:url,vil.nai.com/vil/content/v_145056.htm; classtype:command-and-control; sid:2008515; rev:9; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_02_14;)