Versions (4)
Version DetailsCurrent
Rev: 1 • Jan 26, 2021, 12:00 PMET HUNTING Suspicious POST Format
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Format"; flow:established,to_server; http.method; content:"POST"; http.request_line; content:"/upload/upload.asp HTTP/1.0"; fast_pattern; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; reference:url,norfolkinfosec.com/dprk-malware-targeting-security-researchers/; reference:url,blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/; classtype:bad-unknown; sid:2031560; rev:1; metadata:created_at 2021_01_26, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_01_26;)
Jan 26, 2021, 12:00 PM
Jan 26, 2021, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 15, 2025, 9:36 PM
rules/emerging-hunting.rules