alert http any any -> $HOME_NET any (msg:"ET HUNTING HTTP 300-Series Redirect to file URI attempt"; flow:established,to_client; http.stat_code; content:"3"; startswith; http.location; content:"file|3a 2f 2f|"; nocase; startswith; fast_pattern; reference:url,blog.cylance.com/redirect-to-smb; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/resurrection-of-the-living-dead-the-redirect-to-smb-vulnerability/; classtype:bad-unknown; sid:2020976; rev:6; metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2015_04_23, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, confidence Medium, signature_severity Major, tag Malicious_Redirect, updated_at 2026_07_31, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise; target:dest_ip;)