valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 09:25:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update proxy_susp_flash_download_loc.yml

Browse Source
This commit is contained in:
yugoslavskiy 2020-11-28 18:59:00 +01:00 committed by GitHub
parent 8c2f884504
commit 207623d2d7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
rules/proxy/proxy_susp_flash_download_loc.yml
View File

@ -4,15 +4,15 @@ status: experimental
description: Detects a flashplayer update from an unofficial location
author: Florian Roth
date: 2017/10/25
modified: 2020/11/28
references:
- https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb
logsource:
category: proxy
detection:
selection:
c-uri-query|contains:
- '/install_flash_player.exe'
- '/flash_install.php'
- c-uri-query|contains: '/flash_install.php'
- c-uri-query|endswith: '/install_flash_player.exe'
filter:
c-uri-stem|contains: '.adobe.com/'
condition: selection and not filter