Versions (3)
Version DetailsCurrent
Rev: 4 • Feb 14, 2011, 12:00 PMET MALWARE Rootkit TDSS/Alureon Checkin 2
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rootkit TDSS/Alureon Checkin 2"; flow:established,to_server; http.uri; content:"/dx.php?i="; pcre:"/^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=/Ri"; content:"&x64="; content:"os="; content:"&f="; reference:url,contagiodump.blogspot.com/2011/02/tdss-tdl-4-alureon-32-bit-and-64-bit.html; classtype:command-and-control; sid:2012314; rev:4; metadata:created_at 2011_02_14, signature_severity Major, updated_at 2020_04_21;)
Feb 14, 2011, 12:00 PM
Apr 21, 2020, 12:00 PM
Feb 14, 2011, 12:00 PM
Sep 10, 2024, 1:01 PM
rules/emerging-malware.rules