Rule History

SID: 2011996 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 14 • Dec 6, 2010, 12:00 PM

Message:

ET MALWARE Darkness DDoS Bot Checkin

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Darkness DDoS Bot Checkin"; flow:established,to_server; http.uri; content:".php?uid="; nocase; content:"&ver="; distance:0; pcre:"/\.php\?uid=\d{5,6}&ver=[^&]+(?:&traff=\d+)?$/"; http.header_names; content:!"Accept|0d 0a|"; http.user_agent; content:"darkness"; depth:8; fast_pattern; reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20101205; reference:md5,7fcebf5bd67cede35d08bedd683e3524; reference:md5,60c84bb1ca03f80ca385f16946322440; reference:md5,778113cc4e758ed65de0123bb79cbd1f; reference:md5,55edeb8742f0c38aaa3d984eb4205c68; reference:url,ef.kaffenews.com/?p=833; classtype:command-and-control; sid:2011996; rev:14; metadata:created_at 2010_12_06, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_19;)

Created:

Dec 6, 2010, 12:00 PM

Updated:

May 19, 2020, 12:00 PM

DB Created:

Dec 6, 2010, 12:00 PM

DB Updated:

Oct 6, 2025, 4:34 PM

Filename:

rules/emerging-malware.rules