""ET TROJAN Backdoor.Egobot Checkin""
SID: 2017600
Revision: 2
Class Type: trojan-activity
Metadata: created_at 2013_10_15, updated_at 2015_05_18
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: $HTTP_PORTS
Flow: to_server,established
Contents:
-
Value: ".php?arg1="
-
Value: "&arg2="
Within:
PCRE: "/&arg2=((?:[a-f0-9]{32})|(?:[A-Za-z0-9\x2b\x2f]{4})*(?:[A-Za-z0-9\x2b\x2f]{2}==|[A-Za-z0-9\x2b\x2f]{3}=|[A-Za-z0-9\x2b\x2f]{4}))(?:&|$)/Ui"
Special Options:
-
nocase
-
http_uri
-
http_uri