Versions (5)
Version DetailsCurrent
Rev: 4 • Apr 20, 2015, 12:00 PMET MALWARE Win32/Neutrino Bot Fake 404 Checkin Response
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Neutrino Bot Fake 404 Checkin Response"; flow:to_client,established; http.stat_code; content:"404"; file.data; content:"<!--"; distance:0; content:"NCMD|3a|"; within:6; reference:url,blog.fortinet.com/post/hiding-malicious-traffic-under-the-http-404-error; classtype:command-and-control; sid:2020949; rev:4; metadata:created_at 2015_04_20, malware_family Win32_Neutrino, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_04;)
Apr 20, 2015, 12:00 PM
Aug 4, 2020, 12:00 PM
Apr 20, 2015, 12:00 PM
Oct 10, 2025, 8:34 PM
rules/emerging-malware.rules