Versions (5)
Version DetailsCurrent
Rev: 10 • Aug 26, 2011, 12:00 PMET HUNTING SUSPICIOUS *.doc.exe in HTTP HEADER
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SUSPICIOUS *.doc.exe in HTTP HEADER"; flow:from_server,established; http.header; content:"Content-Disposition|3a| attachment|3b| filename="; nocase; content:".doc.exe"; nocase; distance:0; fast_pattern; classtype:bad-unknown; sid:2013477; rev:10; metadata:created_at 2011_08_26, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)
Aug 26, 2011, 12:00 PM
Apr 21, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 3, 2025, 8:34 PM
rules/emerging-hunting.rules