Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Request to a Malware Related Numerical .cn Domain"; flow:established,to_server; http.host; content:".cn"; endswith; fast_pattern; pcre:"/[^a-z]*[0-9]{4,30}\x2Ecn$/i"; classtype:misc-activity; sid:2012650; rev:8; metadata:created_at 2011_04_08, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_22;)