Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Use in sandbox only, does FP on some traffic (formbook)
- alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"TROJAN Smokeloader Checkin"; flow:established,to_server; content:"POST"; http_method; content:"|50 4f 53 54 20 2f|"; content:"Mozilla|2f|4|2e|0"; http_header; classtype:trojan-activity; sid:20166262; rev:1; metadata:created_at 2018_10_11;)
- v2
- alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"TROJAN Smokeloader Checkin"; flow:established,to_server; content:"POST"; http_method; content:"|50 4f 53 54 20 2f|"; content:"Mozilla|2f|4|2e|0"; http_header; content:"Content-Type|3a 20|application/x-www-form-urlencoded"; http_header; classtype:trojan-activity; sid:20166262; rev:2; metadata:created_at 2018_10_12;)
Advertisement
Add Comment
Please, Sign In to add comment
