""ET TROJAN Filename explorer.exe Download - Common Hostile Filename""
SID: 2020199
Revision: 5
Class Type: trojan-activity
Metadata: created_at 2015_01_16, updated_at 2015_01_16
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "filename="
-
Value: "explorer.exe"
Within: 13
PCRE: "/^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]explorer.exe[\x22\x27]\r\n/Hmi"
Special Options:
-
http_header
-
nocase
-
http_header
-
fast_pattern