I certainly didnít know this! Excellent research and good call not including the rule.
Alex McDonnell <email@example.com>
Thursday, June 7, 2018 3:03:01 PM
Re: [Snort-sigs] Win.Backdoor.Joanap
Yaser, we looked at the User-Agent: DavClnt rule and found there was no distinction between the malicious traffic and traffic from word. Looking at
it seems to be expected fallback behavior. We have decided not to publish this rule.