Versions (3)
Version DetailsCurrent
Rev: 3 • Feb 3, 2015, 12:00 PMET DELETED Dropper YABROD Downloading Files
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Dropper YABROD Downloading Files"; flow:from_client,established; urilen:11; content:"/Yabrod.pdf"; content:"User-Agent|3a 20|n1|0d 0a|"; fast_pattern:12,4; content:!"Referer|3a 20|"; http_header; content:!"|0d 0a|Accept"; http_header; reference:md5,44df02ac28d80deb45f5c7c48b56a858; reference:url,fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-behind-the-syria-conflict.pdf; classtype:trojan-activity; sid:2020346; rev:3; metadata:created_at 2015_02_03, signature_severity Unknown, updated_at 2019_10_16;)
Feb 3, 2015, 12:00 PM
Oct 16, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-deleted.rules