🐾 - 🚨 Suspicious Rclone HTTP connection to Internet 🌐 - Possible file exfiltration 🗃 - Suricata Rule 3300114 (pawpatrules)

🐾 - 🚨 Suspicious Rclone HTTP connection to Internet 🌐 - Possible file exfiltration 🗃

SID: 3300114Rev: 20 views

Sourcepawpatrules

CreatedOctober 10, 2022

UpdatedOctober 10, 2022

Classificationpolicy-violation

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Suspicious Rclone HTTP connection to Internet 🌐 - Possible file exfiltration 🗃"; flow:to_server, stateless; http.user_agent; content:"rclone/"; nocase; reference:url,https://rclone.org/; metadata:created_at 2022_10_10, updated_at 2022_10_10; sid:3300114; rev:2; classtype:policy-violation;)

References

url	https://rclone.org/

Metadata

created at2022_10_10

updated at2022_10_10

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!