Rule History

SID: 2014216 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 3 • Feb 7, 2012, 12:00 PM

Message:

ET RETIRED Delf/Troxen/Zema controller responding to client

Rule:

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET RETIRED Delf/Troxen/Zema controller responding to client"; flow:established,to_client; content:"|0d 0a 0d 0a|wait.<os>"; classtype:trojan-activity; sid:2014216; rev:3; metadata:created_at 2012_02_07, former_category MALWARE, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_12_05;)

Created:

Feb 7, 2012, 12:00 PM

Updated:

Dec 5, 2024, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Oct 20, 2025, 3:34 PM

Filename:

rules/emerging-retired.rules