ET HUNTING Possible EXE Download From Suspicious TLD (.stream) - set

SID: 2023456Rev: 40 views
History
Sourceet/open
CreatedOctober 27, 2016
UpdatedOctober 7, 2020
Classificationmisc-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.stream) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".stream"; fast_pattern; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023456; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, confidence Medium, signature_severity Minor, updated_at 2020_10_07;)

References

urlwww.spamhaus.org/statistics/tlds/

Metadata

affected productAny
attack targetClient_and_Server
created at2016_10_27
confidenceMedium
signature severityMinor
updated at2020_10_07

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!