""ET TROJAN Possible Red October proxy CnC 1""

SID: 2016224

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2013_01_17, updated_at 2013_01_17

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: to_client,established

Contents:

  • Value: "ETag|3a 20 22|8c0bf6-ba-4b975a53906e4|22|"

Within:

PCRE:

Special Options:

  • http_header

source