Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO WinHttpRequest (flowbits no alert)"; flow:established,to_server; flowbits:set,et.WinHttpRequest; flowbits:noalert; http.host; content:!".microsoft.com"; endswith; content:!".qq.com"; endswith; http.user_agent; content:"WinHttp.WinHttpRequest"; fast_pattern; classtype:not-suspicious; sid:2019821; rev:10; metadata:attack_target Client_and_Server, created_at 2014_12_01, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2023_04_20;)