🐾 - 🚨 HTTP Connectivity Check from 📱 iPhone, iPad or iPod 🍏
Sourcepawpatrules
CreatedMay 20, 2022
UpdatedOctober 30, 2023
Classificationpolicy-violation
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 HTTP Connectivity Check from 📱 iPhone, iPad or iPod 🍏"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"captive.apple.com"; nocase; http.user_agent; content:"CaptiveNetworkSupport"; fast_pattern; startswith; nocase; metadata:created_at 2022_05_20, updated_at 2023_10_30; sid:3300053; rev:4; classtype:policy-violation;)
Metadata
created at2022_05_20
updated at2023_10_30
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!