Versions (5)
Version DetailsCurrent
Rev: 6 • Jan 24, 2014, 12:00 PMET HUNTING Suspicious UA (^IE[\d\s])
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious UA (^IE[\d\s])"; flow:established,to_server; http.header; content:!"symantec"; nocase; content:!"norton"; nocase; http.user_agent; content:"IE"; depth:2; nocase; fast_pattern; pcre:"/^[\d\s]/R"; http.host; content:!".bing.com"; reference:md5,209e6701da137084c2f60c90d64505f2; classtype:trojan-activity; sid:2018010; rev:6; metadata:created_at 2014_01_24, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_18;)
Jan 24, 2014, 12:00 PM
Aug 18, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Dec 18, 2025, 10:34 PM
rules/emerging-hunting.rules