Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Activity (POST)"; flow:established,to_server; http.request_line; content:"POST /verst HTTP/1.1"; fast_pattern; http.header_names; content:!"Referer"; content:!"User-Agent"; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; http.request_body; content:"asdasda"; bsize:7; reference:md5,5ae91dc5c2f16efbed5548f489f87b93; reference:md5,56375a0f076613740dac512ffe502c8f; reference:url,unit42.paloaltonetworks.com/trident-ursa/; reference:url,github.com/pan-unit42/iocs/blob/master/Gamaredon/Gamaredon_IoCs_DEC2022.txt; classtype:trojan-activity; sid:2042995; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_12_22, deployment Perimeter, malware_family Gamaredon, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_12_22, reviewed_at 2023_12_11; target:src_ip;)