Versions (3)
Version DetailsCurrent
Rev: 2 • May 21, 2024, 12:00 PMET INFO Dropbox paper Document Request Observed
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Dropbox paper Document Request Observed"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/scl/fi/"; startswith; pcre:"/^[a-zA-Z0-9]{21}\//R"; content:".paper|3f|rlkey|3d|"; fast_pattern; pcre:"/^[a-zA-Z0-9]{21}/R"; http.host; bsize:15; content:"www.dropbox.com"; classtype:misc-activity; sid:2052813; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_05_21, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, tag TA_Abused_Service, updated_at 2026_01_20; target:src_ip;)
May 21, 2024, 12:00 PM
Jan 20, 2026, 12:00 PM
May 21, 2024, 10:00 PM
Jan 20, 2026, 9:34 PM
rules/emerging-info.rules