ET HUNTING Suspicious Use of rzd URL Shortener Service

7.0.35.0SID: 2031647Rev: 2Enabled0 views
Sourceet/open
Fileemerging-hunting.rules
CreatedFebruary 22, 2021
UpdatedMarch 25, 2024
Classificationpolicy-violation
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Use of rzd URL Shortener Service"; flow:established,to_server; http.method; content:"HEAD"; http.host; bsize:6; content:"rzd.ac"; fast_pattern; classtype:policy-violation; sid:2031647; rev:2; metadata:created_at 2021_02_22, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_25;)

Metadata

created at2021_02_22
confidenceMedium
signature severityInformational
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_03_25

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!