""ET TROJAN Mirage Campaign checkin (port 443)""

SID: 2015715

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2012_09_19, updated_at 2012_09_20

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: 443

Flow: established,to_server

Contents:

• Value: "POST " Depth: 5

• Value: "/result?hl=" Depth: 11 Offset: 5

• Value: "&meta="

• Value: "|0d 0a 0d 0a|Mjtdkj"

Within:

PCRE:

Special Options:

source