infection-match (Network Security)

CEF:0|Trellix|MPS|9.0.2.924861|IM|infection-match|1|rt=Oct 16 2020 14:36:12 UTC src=xxx.xxx.xxx.xxx
cn3Label=cncPort cn3=80 cn2Label=sid cn2=84400123 requestMethod=GET proto=tcp spt=1058 dst=xxx.xxx.xxx.xxx
cs5Label=cncHost cs5=xxx.xxx.xxx.xxx dvchost=abc.mrl.trellix.com dvc=xx.x.x.xxx smac=6a:c0:02:9a:9b:7d
cn1Label=vlan cn1=0 dpt=80 externalId=84 cs4Label=link cs4=https://abc.mrl.trellix.com/event_stream/
events_for_bot?ev_id\=84 act=notified cs6Label=channel cs6=GET http://yy8311.com/?/goods_list/14_25_0 HTTP/
1.1::~~Host: yy8311.com::~~/7^{xd_.4\=k]}xFs`kz{\\y[OdGp7y{g xa%k_M?~}oxcx\\{\|Z_h~x8?t\|m_Od0\\GA_{O\=Q}G/UG
+;po\\G/v^pupnp;]\=\|\={~/yNV\|x\|[_\\S/]c^]/\|ic}[6 7Z_`c8]{r\=;_u7\=~o.5W62>4w_s>X)cQ>zk^%O?EO])-
a4q8C[WO{gwx*;?~?{{?][p^{gg{~_y\|}okak/iz<gk?.?qW::UnID.1L31fxL~~y4 mo::[W}{_}+w_yk9~]<N?88^}]:96h~"4_~Uy/?
v<6X{l?cQW?+<zzyn?>x,O\=>7?'>xy_y{t?>}W>%KY-<G\|iiU 94pnPZgs[yN!\=b9\=47%u^g+G(kRGe>e?CNGc\
\B2O2mmgO};e[^s(jbMOZV dmac=00:50:56:e5:3f:c5 cs1Label=sname cs1=Worm.Ramnit
devicePayloadId=6d8cfac0-549b-45f4-9781-72bf2873441d start=Oct 16 2020 14:36:12 UTC .