backdoor.rules

IPv4和IPv6下发任意包的程序

var HOME_NET any
var EXTERNAL_NET any

lert tcp $EXTERNAL_NET 27374 -> $HOME_NET any (msg: "BACKDOOR SIG - SubSseven 22"; flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids,485;)
alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 2589 (msg: "BACKDOOR - Dagger_1.4.0_client_connect"; flags: A+; content: "|0b 00 00 00 07 00 00 00|Connect"; depth: 16; reference:arachnids,483;)
alert tcp $HOME_NET 2589 -> $EXTERNAL_NET 1024: (msg: "BACKDOOR - Dagger_1.4.0"; flags: A+; content: "|3200000006000000|Drives|2400|"; depth: 16; reference:arachnids,484;)