Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cridex Post to CnC"; flow:established,to_server; content:"|0d 0a 0d 0a de ad be ef|"; fast_pattern; http.method; content:"POST"; http.uri; content:!"."; http.host; content:!"hbi-ingest.net"; reference:url,vrt-blog.snort.org/2012/07/banking-trojan-spread-via-ups-phish.html; reference:url,www.virustotal.com/file/00bf5b6f32b6a8223b8e55055800ef7870f8acaed334cb12484e44489b2ace24/analysis/; reference:url,www.packetninjas.net; classtype:command-and-control; sid:2015028; rev:8; metadata:created_at 2012_07_06, signature_severity Major, updated_at 2020_11_05;)