alert tcp [$HOME_NET,$HTTP_SERVERS] any -> $EXTERNAL_NET any (
msg:"ET POLICY RMI Request Outbound";
flow:established,to_server;
stream_size:server,<,5;
flowbits:set,ET.RMIRequest;
flowbits:isnotset,ET.RMIRequest;
content:"|4a 52 4d 49 00|"; startswith; fast_pattern;
pcre:"/^(?:\x01|\x02)(?:\x4b|\x4c|\x4d)/R";
reference:url,docs.oracle.com/javase/9/docs/specs/rmi/protocol.html;
reference:url,github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/lib/rex/proto/rmi/model.rb;
classtype:policy-violation;
sid:2034718; rev:3;
metadata:attack_target Client_and_Server, created_at 2021_12_14, deployment Perimeter, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_12_16;
)