ET HUNTING Suspicious User-Agent Beginning with digits - Likely spyware/trojan
Sourceet/open
CreatedJuly 30, 2010
UpdatedFebruary 27, 2024
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET HUNTING Suspicious User-Agent Beginning with digits - Likely spyware/trojan"; flow:established,to_server; http.header_names; content:"|0d 0a|User-Agent|0d 0a|"; fast_pattern; http.user_agent; content:!"Mozilla/"; pcre:"/^\d+/"; http.host; content:!"liveupdate.symantecliveupdate.com"; classtype:trojan-activity; sid:2010697; rev:9; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Major, tag User_Agent, updated_at 2024_02_27;)
Metadata
affected productAny
attack targetClient_Endpoint
created at2010_07_30
deploymentPerimeter
deprecation reasonPerformance
performance impactSignificant
confidenceMedium
signature severityMajor
tagUser_Agent
updated at2024_02_27
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!