Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HTML/Qbot Dropper (.zip)"; flow:established,to_client; http.response_body; content:"|3c|head|3e 0d 0a 3c|title|3e 20|Adobe|20|Reader|20 3c 2f|title|3e 0d 0a 3c 2f|head|3e|"; reference:url,twitter.com/ankit_anubhav/status/1579548915527200768; reference:md5,5544eada611b649776259df7342b4d9a; classtype:trojan-activity; sid:2039156; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_10_11, deployment Perimeter, deprecation_reason Age, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_12_02, reviewed_at 2024_12_02;)