Rule History

SID: 2019395 • Source: et/open

Versions (5)

Version DetailsCurrent

Rev: 2 • Oct 14, 2014, 12:00 PM

Message:

ET MALWARE Possible SandWorm INF Download

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible SandWorm INF Download"; flow:to_client,established; file_data; content:"Software|5c|Microsoft|5c|Windows|5c|CurrentVersion|5c|Run"; nocase; content:"7EBEFBC0-3200-11d2-B4C2-00A0C9697D17"; nocase; content:"ClassGuid"; nocase; content:"DefaultInstall"; nocase; classtype:attempted-user; sid:2019395; rev:2; metadata:created_at 2014_10_14, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)

Created:

Oct 14, 2014, 12:00 PM

Updated:

Jul 26, 2019, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Oct 16, 2025, 8:36 PM

Filename:

rules/emerging-malware.rules