Rule History

SID: 2019945 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 5 • Dec 16, 2014, 12:00 PM

Message:

ET MALWARE Trojan.Agent.AIXD Checkin

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Agent.AIXD Checkin"; flow:to_server,established; http.uri; content:"/cnc.php?id="; fast_pattern; content:"&uid="; http.user_agent; content:"AppleMac"; bsize:8; reference:md5,801e450679e9d60f8c64675c432aab33; reference:md5,ad2e8210ca7c2b4b433b3fba65e87b94; reference:md5,f6ea10f719885fbcfb6743724faa94f7; classtype:command-and-control; sid:2019945; rev:5; metadata:created_at 2014_12_16, signature_severity Major, updated_at 2020_09_28;)

Created:

Dec 16, 2014, 12:00 PM

Updated:

Sep 28, 2020, 12:00 PM

DB Created:

Dec 16, 2014, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-malware.rules