Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Phoenix Exploit Kit - PROPFIND AVI"; flow:established,to_server; http.method; content:"PROPFIND"; http.uri; content:".avi"; classtype:exploit-kit; sid:2011513; rev:7; metadata:created_at 2010_09_27, signature_severity Unknown, updated_at 2021_06_23;)