ET DELETED Suspicious User Agent (Zlob Related) (UA00000)
Sourceet/open
CreatedJuly 30, 2010
UpdatedJune 23, 2021
Classificationtrojan-activity
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Suspicious User Agent (Zlob Related) (UA00000)"; flow:to_server,established; content:"User-Agent|3a| Mozilla/4.0 (compatible"; http_header; content:"|3b| UA"; fast_pattern; http_header; pcre:"/User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H"; classtype:trojan-activity; sid:2008083; rev:14; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2021_06_23;)
Metadata
created at2010_07_30
signature severityUnknown
updated at2021_06_23
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!