""ET TROJAN Sednit Connectivity Check 0 Byte POST""
SID: 2021506
Revision: 4
Class Type: trojan-activity
Metadata: created_at 2015_07_22, performance_impact Significant, updated_at 2024_04_29
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: $HTTP_PORTS
Flow: to_server,established
Contents:
-
Value: "POST"
-
Value: "Host|3a 20|"
-
Value: "google."
-
Value: !"Referer|3a|"
-
Value: !"=http"
-
Value: "Content-Length|3A| 0|0D 0A|"
-
Value: "/?"
Within: 16
PCRE: "/^Host\x3a\x20(?:www.)?google(?:.[a-z]{2,3})+\r?$/Hm"
Special Options:
-
http_method
-
http_header
-
http_header
-
http_header
-
http_uri
-
http_header
-
http_uri