Rule History

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely CryptoWall .onion Proxy domain in SNI"; flow:established,to_server; tls.sni; content:"kpai7ycr7jxqkilp."; fast_pattern; startswith; classtype:trojan-activity; sid:2018610; rev:4; metadata:created_at 2014_06_27, deprecation_reason Relevance, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_07, reviewed_at 2024_03_07;)