Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related"; flow:established,to_server; http.host; content:".su"; endswith; reference:url,www.abuse.ch/?p=3581; classtype:bad-unknown; sid:2014170; rev:6; metadata:created_at 2012_01_31, confidence High, signature_severity Informational, updated_at 2020_09_16;)