Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential W32/Dridex Alphanumeric Download Pattern"; flow:established,to_server; urilen:9<>47; http.method; content:"GET"; http.uri; content:".exe"; endswith; fast_pattern; pcre:"/^\/(?=[a-z\d]{0,18}(?:[a-z]\d|\d[a-z]|~[a-z])[a-z\d]{0,18}(?:\/[a-z\d]{0,18}(?:[a-z]\d|\d[a-z])[a-z\d]{0,18}){1,2}\.exe$)(?=[a-f\d\x2f\x7e]{0,40}[g-z])[a-z0-9~]{2,20}(?:\/[a-z0-9]{2,20}){1,2}\.exe$/"; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|Accept|0d 0a|"; http.user_agent; pcre:"/(?:MSIE|rv\x3a11\.0)/"; reference:md5,03c5bfb5c0c7a936ad62ebe03019edd0; classtype:trojan-activity; sid:2021607; rev:8; metadata:created_at 2015_08_11, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_01;)