Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Kuluoz.B Spam Campaign Shipment_Label.exe in Zip"; flow:from_server,established; content:"Shipment_Label.zip"; nocase; fast_pattern:only; http_header; file_data; content:"PK"; within:2; content:".exe"; distance:0; classtype:trojan-activity; sid:2017003; rev:3; metadata:created_at 2013_06_12, signature_severity Unknown, updated_at 2019_09_09;)