SUSPICIOUS Anachronistic User-Agent IE11/Win7 (Possible revsocks)

SID: 3500116Rev: 1Enabled3 views
Filehunters-ledger.rules
CreatedJuly 6, 2026
UpdatedJuly 6, 2026
Classificationpolicy-violation
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"SUSPICIOUS Anachronistic User-Agent IE11/Win7 (Possible revsocks)"; flow:to_server,established; http.user_agent; content:"Windows NT 6.1|3b| Trident/7.0"; nocase; threshold:type limit, track by_src, count 5, seconds 300; reference:url,the-hunters-ledger.com/reports/webserver-compromise-kit-91-236-230-250/; classtype:policy-violation; sid:3500116; rev:1; metadata:attack_target Client_Endpoint, deployment Perimeter, signature_severity Medium;)

References

urlthe-hunters-ledger.com/reports/webserver-compromise-kit-91-236-230-250/

Metadata

attack targetClient_Endpoint
deploymentPerimeter
signature severityMedium

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!