Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/Jorik DDOS Instructions From CnC Server"; flow:established,to_client; content:"|7C|ddos|7C|"; pcre:"/\x7Cddos\x7C(syn|http)\x7C/"; classtype:command-and-control; sid:2013998; rev:3; metadata:created_at 2011_12_08, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)