Rule History

SID: 2021024 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 2 • Apr 28, 2015, 12:00 PM

Message:

ET SCAN Nmap NSE Heartbleed Response

Rule:

alert tcp $HOME_NET any -> any any (msg:"ET SCAN Nmap NSE Heartbleed Response"; flow:established,from_server; content:"|18 03|"; depth:2; byte_test:1,<,4,2; byte_test:2,>,200,3; content:"|40 00|Nmap ssl-heartbleed"; fast_pattern; classtype:attempted-recon; sid:2021024; rev:2; metadata:created_at 2015_04_28, confidence Medium, signature_severity Minor, updated_at 2022_03_17;)

Created:

Apr 28, 2015, 12:00 PM

Updated:

Mar 17, 2022, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-scan.rules