ET MALWARE Vawtrak/NeverQuest Server Response

flow:established,from_server;
content:"|0d 0a 0d 0a|ok"; fast_pattern;
file_data;
content:"ok"; within:2;
byte_test:1,<,0x1b,0,relative;
content:"|00|"; distance:1; within:1;
flowbits:isset,ET.Vawtrak;

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

• correlates · Suricata flowbits ET.Vawtrak
  • ET MALWARE Vawtrak/NeverQuest Posting Data
  • ET MALWARE Vawtrak/NeverQuest Posting Data
  • ET MALWARE Vawtrak/NeverQuest Posting Data 2
  • ET MALWARE Vawtrak/NeverQuest Posting Data
  • ET MALWARE Vawtrak/NeverQuest Posting Data
  • ET MALWARE Vawtrak/NeverQuest CnC Beacon