Rule History

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET RETIRED Delf/Troxen/Zema controller delivering clickfraud instructions"; flow:established,to_client; content:"|0d 0a 0d 0a|<md5>"; content:"</md5><url>"; distance:16; within:11; classtype:trojan-activity; sid:2014217; rev:4; metadata:created_at 2012_02_07, former_category MALWARE, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_12_05;)