Sagan medium stable other

[FILE-BLUEDOT] PDF Downloaded a suspicious source

[FILE-BLUEDOT] PDF Downloaded a suspicious source

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[FILE-BLUEDOT] PDF Downloaded a suspicious source"; program: snort; bluedot: type ip_reputation, track by_src, mdate_effective_period 3 months, Malicious,Tor,Honeypot,Proxy; content: "FILE-IDENTIFY"; content: "PDF"; classtype: bad-unknown; parse_src_ip: 1; parse_dst_ip: 2; sid:5002913; rev:4;)

Field Validations

Loading…

Comments (0)

Loading comments...