Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 57 views

    ET INFO Suspicious Windows NT Version 9 User-Agent

    Uploaded by

    Jurgen Despriet
    This rule detects suspicious Windows NT version 9 in the User-Agent field of an HTTP request, which does not correspond to a valid Windows version. It will generate an alert if this User-Agent string is seen in an established HTTP session from a home network client to an external server.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    ET INFO Suspicious Windows NT Version 9 User-Agent

    Uploaded by

    Jurgen Despriet
    57 views1 page
    This rule detects suspicious Windows NT version 9 in the User-Agent field of an HTTP request, which does not correspond to a valid Windows version. It will generate an alert if this User-Agent string is seen in an established HTTP session from a home network client to an external server.

    Original Title

    ET INFO Suspicious Windows NT version 9 User-Agent.txt

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This rule detects suspicious Windows NT version 9 in the User-Agent field of an HTTP request, which does not correspond to a valid Windows version. It will generate an alert if this User-Agent string is seen in an established HTTP session from a home network client to an external server.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    57 views1 page

    ET INFO Suspicious Windows NT Version 9 User-Agent

    Uploaded by

    Jurgen Despriet
    This rule detects suspicious Windows NT version 9 in the User-Agent field of an HTTP request, which does not correspond to a valid Windows version. It will generate an alert if this User-Agent string is seen in an established HTTP session from a home network client to an external server.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    of 1

    alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Suspicious Windows NT

    version 9 User-Agent"; flow:established,to_server; http.user_agent;


    content:"Windows NT 9"; nocase; fast_pattern; classtype:trojan-activity;
    sid:2015822; rev:5; metadata:created_at 2012_10_19, updated_at 2020_09_17;)

    You might also like