Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Suspicious User-Agent filled with System Details - GET Request"; flow:established,to_server; content:"GET"; nocase; http_method; content:"mac="; http_user_agent; depth:4; nocase; content:"&hdid="; distance:0; nocase; http_user_agent; content:"&wlid="; nocase; distance:0; http_user_agent; content:"&start="; nocase; distance:0; http_user_agent; content:"&os="; nocase; distance:0; http_user_agent; content:"&mem="; nocase; distance:0; http_user_agent; content:"&alive"; nocase; distance:0; http_user_agent; content:"&ver="; nocase; distance:0; http_user_agent; content:"&mode="; nocase; distance:0; http_user_agent; content:"&guid"; distance:0; http_user_agent; content:"&install="; nocase; distance:0; http_user_agent; content:"&auto="; nocase; distance:0; http_user_agent; content:"&serveid"; nocase; distance:0; http_user_agent; content:"&area="; nocase; distance:0; http_user_agent; classtype:trojan-activity; sid:2009541; rev:9; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, confidence High, signature_severity Major, tag User_Agent, updated_at 2020_02_24;)