Versions (2)
Version DetailsCurrent
Rev: 5 • Sep 27, 2010, 12:00 PMET MALWARE nte Binary Download Attempt (multiple malware variants served)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE nte Binary Download Attempt (multiple malware variants served)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/nte/"; fast_pattern; pcre:"/(\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$/i"; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; http.user_agent; content:"Java"; startswith; reference:url,www.malwaredomainlist.com; reference:url,www.malwareurl.com/search.php?domain=&s=trest1&match=0&rp=200&urls=on&redirs=on&ip=on&reverse=on&as=on; classtype:trojan-activity; sid:2011576; rev:5; metadata:created_at 2010_09_27, signature_severity Major, updated_at 2024_02_08;)
Sep 27, 2010, 12:00 PM
Feb 8, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-malware.rules