Versions (4)
Version DetailsCurrent
Rev: 8 • Jan 23, 2015, 12:00 PMET MALWARE Dridex Post Checkin Activity 2
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dridex Post Checkin Activity 2"; flow:established,to_server; urilen:20<>100; http.header; content:"|0d 0a|Connection|3a 20|Close|0d 0a|User-Agent|3a 20|Mozilla/"; fast_pattern; http.host; pcre:"/^(?=[a-z0-9]{0,19}[A-Z])(?=[A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/"; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|Host|0d 0a|Connection|0d 0a|User-Agent|0d 0a|"; startswith; reference:md5,b9de687cdae55d3c9fcfe6fc8bcdd28f; classtype:command-and-control; sid:2020302; rev:8; metadata:created_at 2015_01_23, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_05;)
Jan 23, 2015, 12:00 PM
Mar 5, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 3, 2025, 8:34 PM
rules/emerging-malware.rules