""ET TROJAN W32/Zbot.Variant CnC Response""
SID: 2018764
Revision: 4
Class Type: trojan-activity
Metadata: created_at 2013_04_26, performance_impact Moderate, updated_at 2024_04_08
Reference:
-
md5
-
0c4d7d9138de7d7919e3b3c33ac2f851
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,from_server
Contents:
-
Value: "200"
-
Value: "Content-Length|3a| 0|0d 0a|Content-Type|3a| text/html|0d 0a 0d 0a|"
Within:
PCRE:
Special Options:
-
http_stat_code
-
http_header