""ET INFO Suspicious Header Name In HTTP Request (U)""

SID: 2053436

Revision: 1

Class Type: misc-activity

Metadata: attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_06_10, deployment Perimeter, deployment SSLDecrypt, confidence Low, signature_severity Informational, updated_at 2024_06_10

Reference:

• md5

• b3b735852084909f82121fd6fbbdeb68

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "|0d 0a|U|3a 20|"

Within:

PCRE:

Special Options:

• http_header

source