""ET TROJAN Possible Win32.Bicololo Checkin""
SID: 2016946
Revision: 2
Class Type: trojan-activity
Metadata: created_at 2013_05_31, updated_at 2013_05_31
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: !80
Flow: established,to_server
Contents:
-
Value: "GET " Depth: 4
-
Value: "/stat/"
Within:
PCRE: "/^\/stat\/[a-z]{3,4}\/\d{1,4}\sHTTP\/1./R"
Special Options:
- nocase