alert http1 $EXTERNAL_NET any -> any any (msg:"ET CURRENT_EVENTS Win32.RBrute Scan (incoming)"; flow:established,to_server; urilen:1; http.uri; content:"/"; http.referer; content:"http|3a|//"; startswith; http.header; pcre:"/^Host\x3a\x20(?P<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a\x20http\x3a\/\/(?P=ipaddr)\//s"; http.user_agent; content:"Microsoft-WebDAV-MiniRedir/5.1.2600"; startswith; fast_pattern; reference:md5,f8ff430aee52da3b4b1759700be9aead; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:attempted-recon; sid:2018354; rev:6; metadata:created_at 2014_04_03, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_07;)