alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET WEB_CLIENT Possible FortDisco Wordpress Brute-force Site list download 10+ wp-login.php";
flow:established,to_client;
file_data;
content:"/wp-login.php|0d 0a|"; nocase;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
content:"/wp-login.php|0d 0a|"; nocase; distance:0;
reference:url,www.arbornetworks.com/asert/2013/08/fort-disco-bruteforce-campaign/;
reference:md5,722a1809bd4fd75743083f3577e1e6a4;
classtype:trojan-activity;
sid:2017310; rev:3;
metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2013_08_12, deployment Datacenter, confidence Medium, signature_severity Major, tag Wordpress, updated_at 2019_07_26;
)