Versions (4)
Version DetailsCurrent
Rev: 2 • Feb 21, 2014, 12:00 PMET MALWARE Ebury SSH Rootkit data exfiltration
alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ebury SSH Rootkit data exfiltration"; content:"|12 0b 01 00 00 01|"; depth:6; pcre:"/^\x12\x0b\x01\x00\x00\x01[\x00]{6}.[a-f0-9]{6,}(([\x01|\x02|\x03]\d{1,3}){4}|\x03::1)\x00\x00\x01/Bs"; reference:url,cert-bund.de/ebury-faq; classtype:trojan-activity; sid:2018164; rev:2; metadata:created_at 2014_02_21, confidence Medium, signature_severity Major, updated_at 2022_07_15;)
Feb 21, 2014, 12:00 PM
Jul 15, 2022, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-malware.rules