snort2-docker/docker/labs/lab1/local.rules
2020-02-24 08:56:30 -05:00

2 lines
222 B
Plaintext
Executable File

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"TEST Curl outbound connection attempt"; flow:to_server,established; content:"User-Agent: "; http_header; content:"curl/"; http_header; fast_pattern; sid:1000000;)