Rule History

alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET INFO Internet Printing Protocol (IPP) Get-Printer-Attributes Outbound Request"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"application/ipp"; fast_pattern; http.user_agent; content:"CUPS|2f|"; startswith; http.header; content:"|0d 0a|Expect|3a 20|100-continue"; http.request_body; content:"|00 0b|"; offset:2; depth:2; classtype:misc-activity; sid:2056212; rev:1; metadata:created_at 2024_09_26, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_09_26;)