Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows Quicktime User-Agent EOL With Known Bugs"; flow:established,to_server; threshold: type limit, count 1, seconds 600, track by_src; http.user_agent; content:"QuickTime"; content:"os=Windows NT"; fast_pattern; distance:0; reference:url,www.us-cert.gov/ncas/alerts/TA16-105A; classtype:policy-violation; sid:2022738; rev:4; metadata:created_at 2016_04_18, confidence High, signature_severity Informational, updated_at 2020_06_30;)