ET HUNTING Possible EXE Download From Suspicious TLD (.icu) - set
Sourceet/open
CreatedFebruary 6, 2019
UpdatedAugust 27, 2020
Classificationmisc-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.icu) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".icu"; fast_pattern; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2026891; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_02_06, deployment Perimeter, confidence Medium, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_27;)
References
Metadata
attack targetClient_Endpoint
created at2019_02_06
deploymentPerimeter
confidenceMedium
signature severityMinor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2020_08_27
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!