Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Worm W32.Svich or Other Infection Request for setting.ini"; flow:established,to_server; http.uri; content:"/setting.ini"; nocase; reference:md5,36d9a446d6311f9a4c19865e2b62f15d; reference:md5,fcb828c0b735ea8d560a45b3bdd29b94; classtype:trojan-activity; sid:2012198; rev:6; metadata:created_at 2011_01_17, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_06;)