Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Successful PROPFIND Response for Application Media Type"; flow:established,to_client; flowbits:isset,ET.PROPFIND; http.stat_code; content:"207"; file.data; content:"|3d 22|DAV|3a 22 3e|"; content:"response>"; distance:0; content:"href>"; distance:0; content:":href>"; distance:0; content:"status>HTTP/1.1 200 OK"; content:"getcontenttype>application/"; fast_pattern; reference:url,iana.org/assignments/media-types/media-types.xhtml; reference:url,datatracker.ietf.org/doc/html/rfc4918#section-9.1; classtype:misc-activity; sid:2049438; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_11_30, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_11_30;)