Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Symantec Messaging Gateway 9.5.3-3 - Arbitrary file download 2"; flow:to_server,established; content:"|2e 2e 2f|"; depth:200; http.uri; content:"/brightmail/admin/restore/download.do?"; content:"&localBackupFileSelection="; reference:url,www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00; classtype:attempted-user; sid:2016119; rev:4; metadata:created_at 2012_12_04, signature_severity Major, updated_at 2020_04_22;)