ET CHAT IRC USER Off-port Likely bot with 0 0 colon checkin
Sourceet/open
CreatedJuly 13, 2013
UpdatedJuly 26, 2019
Classificationmisc-activity
alert tcp any any -> any !6666:7000 (msg:"ET CHAT IRC USER Off-port Likely bot with 0 0 colon checkin"; flow:to_server,established; content:"USER|20|"; nocase; content:" 0 0 |3a|"; within:40; content:"|0a|"; within:40; flowbits:set,is_proto_irc; classtype:misc-activity; sid:2025067; rev:1; metadata:created_at 2013_07_13, confidence Medium, signature_severity Informational, updated_at 2019_07_26;)
Metadata
created at2013_07_13
confidenceMedium
signature severityInformational
updated at2019_07_26
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!