Rule History

alert http $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"ET MALWARE UPDATE Protocol Trojan Communication detected on non-http ports"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"/update?product=windows"; fast_pattern; http.user_agent; bsize:54; content:"Mozilla|2f|4|2e|0|20 28|compatible|3b 20|MSIE|20|6|2e|0|3b 20|Windows|20|NT|20|5|2e|1|3b|SV1|3b|"; http.header_names; content:"|0d 0a|X-Status|0d 0a|"; content:"|0d 0a|X-Size|0d 0a|"; content:"|0d 0a|X-Sn|0d 0a|"; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014224; rev:5; metadata:created_at 2012_02_14, signature_severity Major, updated_at 2024_02_16;)