""ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz""

SID: 2018141

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2014_02_15, updated_at 2022_08_11, reviewed_at 2024_04_23

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "Set-Cookie|3a 20|snkz="

Within:

PCRE: "/^snkz\x3D\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/C"

Special Options:

• fast_pattern

source