Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Snake rootkit usermode-centric encrypted command from server"; flow:to_client,established; http.stat_code; content:"200"; file.data; content:"|01 00 00 00 00 00 00 00|1dM3uu4j7Fw4sjnb"; fast_pattern; reference:url,info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.pdf; classtype:trojan-activity; sid:2018248; rev:4; metadata:created_at 2014_03_11, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_06;)