Snort mailing list archives
Zeus P2P-proxy sig
From: James Lay <jlay () slave-tothe-box net>
Date: Fri, 07 Jun 2013 13:22:20 -0600
Yep. alert tcp $HOME_NET any -> $EXTERNAL_NET 10000:30000 (msg:"MALWARE-CNC Zeus P2P-proxy C2 Write command"; flow:to_server,established; content:"POST |2f|write HTTP|2f|1.1"; depth:25; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,http://www.cert.pl/PDF/2013-06-p2p-rap_en.pdf; classtype:trojan-activity; sid:10000075; rev:1;) James ------------------------------------------------------------------------------ How ServiceNow helps IT people transform IT departments: 1. A cloud service to automate IT design, transition and operations 2. Dashboards that offer high-level views of enterprise services 3. A single system of record for all IT processes http://p.sf.net/sfu/servicenow-d2d-j _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Zeus P2P-proxy sig James Lay (Jun 07)
- Re: Zeus P2P-proxy sig Joel Esler (Jun 07)
- Re: Zeus P2P-proxy sig James Lay (Jun 07)
- Re: Zeus P2P-proxy sig Joel Esler (Jun 07)