Rule History

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET INFO Suspicious Large HTTP Header Key Observed - Possible Exploit Activity"; flow:to_server,established; http.header; pcre:"/^[^\x3a]{400,}/m"; classtype:misc-activity; sid:2043304; rev:1; metadata:created_at 2023_01_13, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Informational, tag possible_exploitation, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_01_13;)