Rule History

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Observed OSX/PremierOpinionD Collection Domain in TLS SNI"; flow:established,to_server; threshold: type limit, track by_src, count 1, seconds 600; tls.sni; content:"oss-content.securestudies.com"; endswith; reference:url,www.airoav.com/mitm-voicefive; classtype:pup-activity; sid:2027694; rev:5; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2019_07_09, deployment Perimeter, malware_family PremierOpinionD, performance_impact Low, confidence High, signature_severity Minor, updated_at 2020_09_17;)