ET HUNTING HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header

Query · suricata

flow:established,to_server;
http.header;
content:"Upgrade|3a 20|h2c"; fast_pattern;
content:"HTTP2-Settings|3a 20|AAMAAABkAARAAAAAAAIAAAAA";
content:"Connection|3a 20|Upgrade|0d 0a|";
target:dest_ip;
Raw source ET HUNTING HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http any any -> $HOME_NET any (
    msg:"ET HUNTING HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header";
    flow:established,to_server;
    http.header;
    content:"Upgrade|3a 20|h2c"; fast_pattern;
    content:"HTTP2-Settings|3a 20|AAMAAABkAARAAAAAAAIAAAAA";
    content:"Connection|3a 20|Upgrade|0d 0a|";
    reference:url,www.assetnote.io/resources/research/h2c-smuggling-in-the-wild;
    classtype:web-application-activity;
    sid:2061769; rev:1;
    metadata:attack_target Web_Server, created_at 2025_04_21, deployment Perimeter, confidence Medium, signature_severity Major, updated_at 2025_04_21;
    target:dest_ip;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.