""ET TROJAN Comfoo Checkin""
SID: 2017262
Revision: 2
Class Type: trojan-activity
Metadata: created_at 2013_08_01, updated_at 2013_08_01
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: any
Flow: established,to_server
Contents:
-
Value: "GET " Depth: 4
-
Value: "|3b|Windows"
Within:
PCRE: "/^User-Agent\x3a[^\r\n]*?\x3bWindows/mi"
Special Options:
- nocase