Rule History

SID: 2018295 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 6 • Mar 18, 2014, 12:00 PM

Message:

ET MALWARE Mal/Ransom-CE Connectivity Check

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mal/Ransom-CE Connectivity Check"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/windows"; fast_pattern; endswith; http.user_agent; content:"MSIE"; http.host; content:"www.microsoft.com"; bsize:17; http.header_names; content:!"Accept"; content:!"Referer|0d 0a|"; content:"|0d 0a|User-Agent|0d 0a|"; startswith; reference:md5,6faa7077de347ee0fa8c991934c2c3a5; reference:md5,a1fe3a7ff1ec997411b71212483eea33; reference:md5,97c0000473c5004d2e8c0464e322f429; classtype:trojan-activity; sid:2018295; rev:6; metadata:created_at 2014_03_18, performance_impact Moderate, signature_severity Major, updated_at 2024_04_08;)

Created:

Mar 18, 2014, 12:00 PM

Updated:

Apr 8, 2024, 12:00 PM

DB Created:

Mar 18, 2014, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-malware.rules