🐾 - 🚨 Suspicious Windows 🪟 TLSv1.2 connection to github.com - possible unwanted application
Sourcepawpatrules
CreatedJuly 26, 2023
UpdatedDecember 31, 2023
Classificationpolicy-violation
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Suspicious Windows 🪟 TLSv1.2 connection to github.com - possible unwanted application"; flow:to_server, stateless; ja3.hash; content:"3b5074b1b5d032e5620f69f9f700ff0e"; fast_pattern; tls_sni; content:"github.com"; endswith; nocase; metadata:created_at 2023_07_26, updated_at 2023_12_31; sid:3300229; rev:2; classtype:policy-violation;)
Metadata
created at2023_07_26
updated at2023_12_31
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!