Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE XML Style POST Of IMEI International Mobile Equipment Identity"; flow:established,to_server; http.method; content:"POST"; nocase; http.host; content:!".blackberry.com"; content:!".nokia.com"; content:!".sonyericsson.com"; http.request_body; content:"<IMEI>"; nocase; content:"<|2F|IMEI>"; fast_pattern; nocase; distance:0; reference:url,www.met.police.uk/mobilephone/imei.htm; classtype:trojan-activity; sid:2013138; rev:10; metadata:created_at 2011_06_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_18;)