Versions (3)
Version DetailsCurrent
Rev: 2 • Feb 18, 2016, 12:00 PMET MALWARE Possible OceanLotus Time Check to Microsoft.com
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible OceanLotus Time Check to Microsoft.com"; flow:to_server,established; content:"GET|20 20|HTTP/1.0|0d 0a|"; depth:15; content:"www.microsoft.com"; distance:6; within:23; reference:url,www.alienvault.com/open-threat-exchange/blog/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update; classtype:targeted-activity; sid:2022539; rev:2; metadata:created_at 2016_02_18, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Feb 18, 2016, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-malware.rules