Versions (2)
Version DetailsCurrent
Rev: 2 • Jul 12, 2012, 12:00 PMET DELETED HTTP Request to a Zeus CnC DGA Domain hvpmffxpfnlquqxo.ru
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED HTTP Request to a Zeus CnC DGA Domain hvpmffxpfnlquqxo.ru"; flow:established,to_server; content:"|3a| hvpmffxpfnlquqxo.ru|0D 0A|"; fast_pattern:only; http_header; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015185; rev:2; metadata:created_at 2012_07_12, signature_severity Unknown, updated_at 2019_07_26;)
Jul 12, 2012, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-deleted.rules