Rule History

SID: 2019207 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 1 • Sep 22, 2014, 12:00 PM

Message:

ET MALWARE Linux/BillGates Checkin

Rule:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/BillGates Checkin"; flow:established,to_server; content:"|01 00 00 00|"; depth:4; content:"|00 00 00 f4 01 00 00 32 00 00 00 e8 03|"; distance:0; content:"|01 01 02 00 00 00 01 00 00 00|"; distance:0; reference:md5,b4dd0283c73d0b288e7322b95df0cb1b; classtype:command-and-control; sid:2019207; rev:1; metadata:created_at 2014_09_22, confidence High, signature_severity Major, updated_at 2019_07_26;)

Created:

Sep 22, 2014, 12:00 PM

Updated:

Jul 26, 2019, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-malware.rules