Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32 Bamital or Backdoor.Win32.Shiz CnC Communication"; flow:established,to_server; http.uri; content:"/favicon.ico?0="; content:"&1="; content:"&2="; content:"&3="; content:"&4="; content:"&5="; content:"&6="; content:"&7="; reference:md5,fbcdfecc73c4389e8d3ed7e2e573b6f1; classtype:command-and-control; sid:2012299; rev:4; metadata:created_at 2011_02_07, signature_severity Major, updated_at 2020_04_20;)