Versions (5)
Version DetailsCurrent
Rev: 2 • Mar 19, 2025, 4:38 PMTGI HUNT Serialized Object PHP inbound
alert http any any -> $HOME_NET any (msg:"TGI HUNT Serialized Object PHP inbound"; flow:established,to_server; content:"O|3a|"; pcre:"/\d+\x3a[ -~]*?\x3a\d+\x3a\{/iR"; content:"|3a|{"; fast_pattern; threshold:type limit, track by_src, seconds 60, count 1; classtype:bad-unknown; sid:2610296; rev:2;)
Mar 19, 2025, 4:38 PM
Mar 19, 2025, 4:38 PM
Jul 29, 2025, 5:35 PM
Jul 29, 2025, 5:35 PM
hunting.rules