""ET INFO Possible MSXMLHTTP Request to Dotted Quad""

SID: 2022054

Revision: 2

Class Type: misc-activity

Metadata: created_at 2015_11_10, updated_at 2015_11_16

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: to_server,established

Contents:

• Value: "HTTP/1.1|0d 0a|Accept|3a 20|/|0d 0a|Accept-Encoding|3a 20|gzip, deflate|0d 0a|User-Agent|3a 20|Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT"

• Value: !"|0d 0a|UA-CPU|3a|"

• Value: !"|0d 0a|Cookie|3a|"

• Value: !"|0d 0a|Referer|3a|"

• Value: !"|0d 0a|Accept-Language|3a|"

Within:

PCRE: "/^[^\r\n]+\r\nHost\x3a\x20\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}(?:\x3a\d{1,5})?\r\n/R"

Special Options:

source