Rule History

alert http $HOME_NET any -> $EXTERNAL_NET 897 (msg:"ET DELETED Backdoor PcClient.CAK.Pakes POST on non-http Port"; flow:established,to_server; content:"POST"; nocase; http_method; content:".jsp"; nocase; depth:35; pcre:"/\/\d{8,}\/\d{4,}\/\d{4,}\.jsp/"; classtype:trojan-activity; sid:2009093; rev:5; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)