Rule History

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET POLICY Cisco Data Center Network Manager Version Check Inbound (flowbit set)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/fm/fmrest/about/version"; endswith; fast_pattern; flowbits:set,ET.ciscodcnm.1; reference:url,www.exploit-db.com/exploits/47347; classtype:attempted-recon; sid:2033441; rev:1; metadata:created_at 2021_07_27, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_27;)