Versions (2)
Version DetailsCurrent
Rev: 7 • Nov 15, 2010, 12:00 PMET MALWARE Rogue AV Downloader concat URI
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rogue AV Downloader concat URI"; flow:established,to_server; http.uri; content:".php?id="; content:"x="; distance:0; content:"os="; distance:0; content:"n="; distance:0; pcre:"/\.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d/"; reference:url,malwareurl.com; classtype:trojan-activity; sid:2011925; rev:7; metadata:created_at 2010_11_15, signature_severity Major, updated_at 2020_05_06;)
Nov 15, 2010, 12:00 PM
May 6, 2020, 12:00 PM
Nov 15, 2010, 12:00 PM
Sep 10, 2024, 1:01 PM
rules/emerging-malware.rules