SUSPICIOUS [PTsecurity] PROPFIND method in HTTP Request
Sourceptrules/open
CreatedSeptember 25, 2025
UpdatedMarch 11, 2026
Classificationmisc-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"SUSPICIOUS [PTsecurity] PROPFIND method in HTTP Request"; flow:established, to_server; urilen:>2; http.method; content:"PROPFIND"; startswith; http.header; content:"Connection|3a| Keep-Alive|0d 0a|User-Agent|3a| Microsoft-WebDAV-MiniRedir"; content:"Content-Length|3a| 0"; threshold:type limit, track by_src, seconds 300, count 1; reference:url, app.any.run/tasks/cdb665b2-f591-4fa6-9e70-478d01d1ee96/; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10008218; rev:4;)
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!