ET HUNTING HTTP 300-Series Redirect to file URI attempt

Query · suricata

flow:established,to_client;
http.stat_code;
content:"3"; startswith;
http.location;
content:"file|3a 2f 2f|"; nocase; startswith; fast_pattern;
target:dest_ip;
Raw source ET HUNTING HTTP 300-Series Redirect to file URI attempt · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http any any -> $HOME_NET any (
    msg:"ET HUNTING HTTP 300-Series Redirect to file URI attempt";
    flow:established,to_client;
    http.stat_code;
    content:"3"; startswith;
    http.location;
    content:"file|3a 2f 2f|"; nocase; startswith; fast_pattern;
    reference:url,blog.cylance.com/redirect-to-smb;
    reference:url,blog.trendmicro.com/trendlabs-security-intelligence/resurrection-of-the-living-dead-the-redirect-to-smb-vulnerability/;
    classtype:bad-unknown;
    sid:2020976; rev:6;
    metadata:affected_product Any, attack_target Client_and_Server, tls_state plaintext, created_at 2015_04_23, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, confidence Medium, signature_severity Major, tag Malicious_Redirect, updated_at 2026_07_31, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;
    target:dest_ip;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.