Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Password Stealer (PSW.Win32.Magania Family) GET"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"pass="; content:"type="; content:"host="; content:"port="; content:"name="; content:"pc="; content:"user="; content:"ip="; content:"version="; http.header; content:"User-Agent|3a| NR"; fast_pattern; reference:url,www.f-secure.com/v-descs/trojan-psw_w32_magania.shtml; reference:url,www.threatexpert.com/reports.aspx?find=Trojan-PWS.Magania; classtype:trojan-activity; sid:2009094; rev:9; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_12;)