Versions (3)
Version DetailsCurrent
Rev: 1 • Jul 7, 2024, 12:00 PMET HUNTING Server Responding to JPG Request with Fake JPG Structure
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Server Responding to JPG Request with Fake JPG Structure"; flow:established,to_client; flowbits:isset,ET.Outbound.JPG.Req; http.stat_code; content:"200"; http.response_body; content:"|ff d8|"; startswith; content:!"JFIF"; within:50; content:"OOOOOOOO"; fast_pattern; content:"|00 00 00 00 00 00 00|"; within:100; classtype:bad-unknown; sid:2054406; rev:1; metadata:created_at 2024_07_07, performance_impact Moderate, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_07_08;)
Jul 7, 2024, 12:00 PM
Jul 8, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Aug 11, 2025, 10:35 PM
rules/emerging-hunting.rules