""ET SMTP Possible ComputerCop Log Transmitted via SMTP""

SID: 2019340

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2014_10_02, updated_at 2014_10_02

Reference:

• Link

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: any

Destination Port: [25,587]

Flow: to_server,established

Contents:

• Value: "Subject|3a 20|CCOP|20|"

Within:

PCRE:

Special Options:

• nocase

source