Versions (4)
Version DetailsCurrent
Rev: 3 • Jun 7, 2013, 12:00 PMET INFO Executable Served From /tmp/ Directory - Malware Hosting Behaviour
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Executable Served From /tmp/ Directory - Malware Hosting Behaviour"; flow:established,to_server; http.uri; content:"/tmp/"; depth:5; content:".exe"; distance:0; pcre:"/^\/tmp\/.+\.exe$/"; classtype:bad-unknown; sid:2016985; rev:3; metadata:created_at 2013_06_07, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_24;)
Jun 7, 2013, 12:00 PM
Apr 24, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Nov 4, 2025, 10:34 PM
rules/emerging-info.rules