Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN Yahoo Crawler Crawl"; flow:established,to_server; http.user_agent; content:"Yahoo-MMCrawler"; nocase; threshold: type both, track by_src, count 10, seconds 60; reference:url,mms-mmcrawler-support@yahoo-inc.com; classtype:attempted-recon; sid:2002833; rev:8; metadata:attack_target Web_Server, created_at 2010_07_30, deployment Perimeter, confidence Medium, signature_severity Informational, tag WebCrawler, updated_at 2024_02_06, mitre_tactic_id TA0043, mitre_tactic_name Reconnaissance, mitre_technique_id T1593, mitre_technique_name Search_Open_Websites;)