Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic - POST To .php w/Extended ASCII Characters"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; http.user_agent; content:"|20|MSIE|20|"; fast_pattern; http.request_body; pcre:"/[\x80-\xff]/"; http.content_type; content:"www-form-urlencoded"; http.header_names; content:!"Referer"; http.host; content:!".webex.com"; endswith; classtype:trojan-activity; sid:2017259; rev:16; metadata:created_at 2013_07_31, performance_impact Significant, confidence Medium, signature_severity Major, updated_at 2024_04_25;)