Versions (3)
Version DetailsCurrent
Rev: 3 • Feb 27, 2016, 12:00 PMET DELETED Possible Spam/Phish Campaign Feb 25 2016
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Spam/Phish Campaign Feb 25 2016"; flow:established,to_server; content:".pw|0d 0a|"; http_header; nocase; fast_pattern:only; pcre:"/\/[a-z]\/\?[A-Z]{10}$/U"; pcre:"/^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi"; classtype:trojan-activity; sid:2022570; rev:3; metadata:created_at 2016_02_27, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Feb 27, 2016, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Jan 9, 2026, 10:34 PM
rules/emerging-deleted.rules