Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Kelihos.F Checkin"; flow:established,to_server; urilen:<13; http.method; content:"GET"; http.uri; content:".htm"; fast_pattern; pcre:"/^\/[^\x2f]+?\.htm$/"; http.header; content:"Content-Length|3a 20|"; content:!"0|0d 0a|"; within:3; content:"|0d 0a|"; distance:0; http.user_agent; content:!"BridgitAgent"; http.header_names; content:!"Accept"; content:!"Referer"; content:!"Content-Type"; reference:md5,00db349caf2eefc3be5ee30b8b8947a2; classtype:command-and-control; sid:2017191; rev:7; metadata:created_at 2013_07_24, deprecation_reason Age, malware_family Win32_Kelihos_F, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_07, reviewed_at 2024_02_07;)