Rule History

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Known Fraudulent SSL Certificate for www.google.com"; flow:established,from_server; content:"|00 f5 c8 6a f3 61 62 f1 3a 64 f5 4f 6d c9 58 7c 06|"; content:"www.google.com"; within:250; classtype:misc-activity; sid:2012554; rev:8; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_03_24, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, tag Web_Client_Attacks, updated_at 2019_10_14;)