Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fake AV Downloader.Onestage/FakeAlert.ZR User-Agent (AV1)"; flow:established,to_server; http.user_agent; content:"AV1"; depth:3; endswith; reference:md5,208e5551efce47ac6c95691715c12e46; reference:md5,735dff747d0c7ce74dde31547b2b5750; reference:md5,a84a144677a786c6855fd4899d024948; classtype:trojan-activity; sid:2009223; rev:11; metadata:created_at 2010_07_30, confidence High, signature_severity Major, updated_at 2020_10_17;)