Versions (4)
Version DetailsCurrent
Rev: 3 • Dec 4, 2015, 12:00 PMET MALWARE Linux/KDefend Checkin
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/KDefend Checkin"; flow:established,to_server; content:"c|00|h|00|i|00|n|00|a|00 00 00|"; offset:16; depth:12; fast_pattern; content:"|20|MB|00|"; within:10; content:"/proc/stat|00|cpu|00|"; within:21; reference:url,blog.malwaremustdie.org/2015/12/mmd-0045-2015-kdefend-new-elf-threat.html; classtype:command-and-control; sid:2022219; rev:3; metadata:created_at 2015_12_04, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Dec 4, 2015, 12:00 PM
Jul 26, 2019, 12:00 PM
Dec 4, 2015, 12:00 PM
Nov 5, 2025, 10:34 PM
rules/emerging-malware.rules