""ET TROJAN Night Dragon CnC Traffic Outbound 2""

SID: 2012306

Revision: 6

Class Type: trojan-activity

Metadata: created_at 2011_02_10, updated_at 2011_02_14

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "|68 57 24 13|" Depth: 4 Offset: 12

Within:

PCRE:

Special Options:

source