""ET TROJAN Yayih.A Checkin 2""

SID: 2017325

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2013_08_13, updated_at 2013_08_13

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: to_server,established

Contents:

• Value: "POST" Depth: 5

• Value: "/bbs/search.asp" Depth: 15 Offset: 5

• Value: "Mozilla/4.0 (compatible|3b| MSIE 5.0|3b| Windows NT 5.0)|0d 0a|"

Within:

PCRE:

Special Options:

• fast_pattern

source