Rule History

SID: 2016300 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 7 • Jul 20, 2012, 12:00 PM

Message:

ET MALWARE Simda.C Checkin

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Simda.C Checkin"; flow:established,to_server; http.uri; content:"/?"; nocase; http.uri.raw; content:"=%96%"; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MSIE 8.0|3b 20|Trident/4.0|3b 20|.NET CLR 2.0.50727|3b 20|.NET CLR 1.1.4322|3b 20|.NET CLR 3.0.04506.590|3b 20|.NET CLR 3.0.04506.648|3b 20|.NET CLR 3.5.21022|3b 20|.NET CLR 3.0.4506.2152|3b 20|.NET CLR 3.5.30729)"; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|User-Agent|0d 0a 0d 0a|"; depth:22; endswith; reference:md5,10642e1067aca9f04ca874c02aabda5c; classtype:command-and-control; sid:2016300; rev:7; metadata:created_at 2012_07_20, signature_severity Major, updated_at 2020_09_15;)

Created:

Jul 20, 2012, 12:00 PM

Updated:

Sep 15, 2020, 12:00 PM

DB Created:

Jul 20, 2012, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-malware.rules