ET RETIRED Blackshades Payload Download Command

Query · suricata

flow:established,to_client;
content:"x74|0C|64|0C|"; depth:7;
content:"x49|0C|"; distance:64;
target:src_ip;
Raw source ET RETIRED Blackshades Payload Download Command · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET RETIRED Blackshades Payload Download Command";
    flow:established,to_client;
    content:"x74|0C|64|0C|"; depth:7;
    content:"x49|0C|"; distance:64;
    classtype:trojan-activity;
    sid:2014101; rev:3;
    metadata:tls_state plaintext, created_at 2012_01_05, former_category MALWARE, confidence High, signature_severity Major, updated_at 2024_12_05;
    target:src_ip;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.