ET INFO Webhook/HTTP Request Inspection Service Domain (requestinspector .com in TLS SNI)

SID: 2049157Rev: 10 views
History
Sourceet/open
CreatedAugust 25, 2023
UpdatedAugust 25, 2023
Classificationmisc-activity
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Webhook/HTTP Request Inspection Service Domain (requestinspector .com in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".requestinspector.com"; endswith; fast_pattern; reference:url,requestinspector.com; classtype:misc-activity; sid:2049157; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_08_25, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, updated_at 2023_08_25, reviewed_at 2023_08_25, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1102, mitre_technique_name Web_Service;)

References

urlrequestinspector.com

Metadata

attack targetClient_Endpoint
created at2023_08_25
deploymentPerimeter
performance impactLow
confidenceHigh
signature severityInformational
updated at2023_08_25
reviewed at2023_08_25
mitre tactic idTA0011
mitre tactic nameCommand_And_Control
mitre technique idT1102
mitre technique nameWeb_Service

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!