Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN Observed Suspicious UA (Callstranger Vulnerability Checker)"; flow:established,to_server; http.user_agent; content:"Callstranger Vulnerability Checker"; bsize:34; reference:url,github.com/yunuscadirci/CallStranger; classtype:attempted-recon; sid:2030271; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_06_09, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2020_06_09;)