ET HUNTING Fake Windows Powershell User-Agent Observed (powershell)
Sourceet/open
CreatedApril 16, 2026
UpdatedApril 16, 2026
Classificationmisc-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Fake Windows Powershell User-Agent Observed (powershell)"; flow:established,to_server; http.user_agent; bsize:10; content:"powershell"; classtype:misc-activity; sid:2068807; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_04_16, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_04_16; target:src_ip;)
Metadata
affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
attack targetClient_Endpoint
tls stateTLSDecrypt
created at2026_04_16
deploymentSSLDecrypt
confidenceHigh
signature severityInformational
updated at2026_04_16
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!