ET HUNTING HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header

7.0.35.0SID: 2061769Rev: 1Enabled46 views
Sourceet/open
Fileemerging-hunting.rules
CreatedApril 21, 2025
UpdatedApril 21, 2025
Classificationweb-application-activity
alert http any any -> $HOME_NET any (msg:"ET HUNTING HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header"; flow:established,to_server; http.header; to_lowercase; content:"upgrade|3a 20|h2c"; fast_pattern; content:"http2-settings|3a 20|aamaaabkaaraaaaaaaiaaaaa"; content:"connection|3a 20|upgrade|0d 0a|"; reference:url,www.assetnote.io/resources/research/h2c-smuggling-in-the-wild; classtype:web-application-activity; sid:2061769; rev:1; metadata:attack_target Web_Server, created_at 2025_04_21, deployment Perimeter, confidence Medium, signature_severity Major, updated_at 2025_04_21; target:dest_ip;)

References

urlwww.assetnote.io/resources/research/h2c-smuggling-in-the-wild

Metadata

attack targetWeb_Server
created at2025_04_21
deploymentPerimeter
confidenceMedium
signature severityMajor
updated at2025_04_21

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!