ET MALWARE Darkness DDoS Bot Checkin

Query · suricata

flow:established,to_server;
http.uri;
content:".php?uid="; nocase;
content:"&ver="; distance:0;
pcre:"/\.php\?uid=\d{5,6}&ver=[^&]+(?:&traff=\d+)?$/";
http.header_names;
content:!"Accept|0d 0a|";
http.user_agent;
content:"darkness"; depth:8; fast_pattern;
Raw source ET MALWARE Darkness DDoS Bot Checkin · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Darkness DDoS Bot Checkin";
    flow:established,to_server;
    http.uri;
    content:".php?uid="; nocase;
    content:"&ver="; distance:0;
    pcre:"/\.php\?uid=\d{5,6}&ver=[^&]+(?:&traff=\d+)?$/";
    http.header_names;
    content:!"Accept|0d 0a|";
    http.user_agent;
    content:"darkness"; depth:8; fast_pattern;
    reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20101205;
    reference:md5,7fcebf5bd67cede35d08bedd683e3524;
    reference:md5,60c84bb1ca03f80ca385f16946322440;
    reference:md5,778113cc4e758ed65de0123bb79cbd1f;
    reference:md5,55edeb8742f0c38aaa3d984eb4205c68;
    reference:url,ef.kaffenews.com/?p=833;
    classtype:command-and-control;
    sid:2011996; rev:14;
    metadata:created_at 2010_12_06, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_05_19;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.