""ET CHAT IRC USER Likely bot with 0 0 colon checkin""
SID: 2025066
Revision: 1
Class Type: misc-activity
Metadata: created_at 2013_07_13, updated_at 2013_07_13
Reference:
Protocol: tcp
Source Network: any
Source Port: any
Destination Network: any
Destination Port: 6666:7000
Flow: to_server,established
Contents:
-
Value: "USER|20|"
-
Value: " 0 0 |3a|"
-
Value: "|0a|"
Within: 40
PCRE:
Special Options:
- nocase