Snort mailing list archives
Nettraveler sig
From: James Lay <jlay () slave-tothe-box net>
Date: Tue, 04 Jun 2013 15:52:35 -0600
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Nettraveler C2 Control Loop"; flow:to_server,established; content:"nettraveler.asp|3f|action="; http_uri; ; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,http://www.securelist.com/en/downloads/vlpdfs/kaspersky-the-net-traveler-part1-final.pdf; classtype:trojan-activity; sid:10000073; rev:1;) Nice writeup in that PDF. James ------------------------------------------------------------------------------ How ServiceNow helps IT people transform IT departments: 1. A cloud service to automate IT design, transition and operations 2. Dashboards that offer high-level views of enterprise services 3. A single system of record for all IT processes http://p.sf.net/sfu/servicenow-d2d-j _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Nettraveler sig James Lay (Jun 04)
- Re: Nettraveler sig James Lay (Jun 04)
- Re: Nettraveler sig Joel Esler (Jun 04)
- Re: Nettraveler sig Joel Esler (Jun 04)
- Re: Nettraveler sig James Lay (Jun 04)
- Re: Nettraveler sig James Lay (Jun 04)