ET HUNTING Observed Deprecated Github URL Shortener Domain in TLS SNI (git .io)

SID: 2067830Rev: 10 views

Sourceet/open

CreatedFebruary 18, 2026

UpdatedFebruary 18, 2026

Classificationbad-unknown

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Observed Deprecated Github URL Shortener Domain in TLS SNI (git .io)"; flow:established,to_server; tls.sni; bsize:6; content:"git.io"; fast_pattern; reference:url,git.io; classtype:bad-unknown; sid:2067830; rev:1; metadata:attack_target Client_Endpoint, created_at 2026_02_18, deployment Perimeter, performance_impact Low, confidence High, signature_severity Minor, updated_at 2026_02_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;)

References

url

git.io

Metadata

attack targetClient_Endpoint

created at2026_02_18

deploymentPerimeter

performance impactLow

confidenceHigh

signature severityMinor

updated at2026_02_18

mitre tactic idTA0001

mitre tactic nameInitial_Access

mitre technique idT1189

mitre technique nameDrive_by_Compromise

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!