Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM
SUSPICIOUS Anachronistic User-Agent IE11/Win7 (Possible revsocks)
Sourcehunters-ledger
Filehunters-ledger.rules
CreatedJune 25, 2026
UpdatedJune 25, 2026
Classificationpolicy-violation
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"SUSPICIOUS Anachronistic User-Agent IE11/Win7 (Possible revsocks)"; flow:to_server,established ; http.user_agent; content:"Windows NT 6.1|3b| Trident/7.0"; nocase; threshold:type limit, track by_src, count 5, seconds 300 ; reference:tool,revsocks ; classtype:policy-violation; sid:1900101; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, signature_severity Medium;)
References
| tool | revsocks |
Metadata
attack targetClient_Endpoint
deploymentPerimeter
signature severityMedium
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!