Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related"; flow:established,from_server; flowbits:isset,ET.webc2; file_data; content:"<!---<table<b"; reference:url,www.mandiant.com/apt1; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; classtype:targeted-activity; sid:2016438; rev:2; metadata:created_at 2013_02_20, signature_severity Major, updated_at 2019_07_26;)