Rule History

alert http any any -> any any (msg: "ATTACK [PTsecurity] GitHub Electron <1.8.2-beta.4, <1.7.11, <1.6.16 protocol handler RCE (CVE-2018-1000006)"; flow: established, from_server; content: "://"; content: "-cmd-prefix="; nocase; pcre: "/(powershell|cmd|python|bash|\.exe)/i"; reference: cve, 2018-1000006; reference: url, electronjs.org/blog/protocol-handler-fix; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10002501; rev: 3;)