Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN UPnP SUBSCRIBE Inbound - Possible CallStranger Scan (CVE-2020-12695)"; flow:established,to_server; http.method; content:"SUBSCRIBE"; nocase; http.header; content:"CALLBACK|3a 20|"; fast_pattern; content:"NT|3a 20|"; reference:cve,2020-12695; reference:url,kb.cert.org/vuls/id/339275; classtype:attempted-recon; sid:2030272; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_06_09, cve CVE_2020_12695, deployment Perimeter, confidence Medium, signature_severity Informational, updated_at 2020_06_09;)