Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/DMA Locker CnC Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?action="; fast_pattern; content:!".aspx"; pcre:"/\?action=\d(&botId=[A-F0-9]{32})?$/i"; http.header_names; content:"|0d 0a|Host|0d 0a 0d 0a|"; startswith; reference:md5,050f04ed78e96418179228272998d87d; classtype:command-and-control; sid:2022873; rev:5; metadata:created_at 2016_06_07, malware_family Win32_DMA, performance_impact Moderate, confidence High, signature_severity Major, updated_at 2024_04_08;)