Versions (3)
Version DetailsCurrent
Rev: 1 • Aug 29, 2014, 12:00 PMET MALWARE Syrian Malware Checkin
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Syrian Malware Checkin"; flow:established,to_server; content:"|2f|j|7c|n|5c|"; offset:2; depth:5; content:"[endof]"; fast_pattern; distance:0; reference:url,fireeye.com/blog/technical/2014/08/connecting-the-dots-syrian-malware-team-uses-blackworm-for-attacks.html; reference:md5,a8cf815c3800202d448d035300985dc7; classtype:command-and-control; sid:2019084; rev:1; metadata:created_at 2014_08_29, signature_severity Major, updated_at 2019_07_26;)
Aug 29, 2014, 12:00 PM
Jul 26, 2019, 12:00 PM
Aug 29, 2014, 12:00 PM
Sep 10, 2024, 1:01 PM
rules/emerging-malware.rules