2010677 ET MALWARE Suspicious User-Agent (My Session)

Rule Signatures
1

Alerting on legitimate outbound traffic from Aquaveo software.

2

Hi @segers , thanks! Can you share some traffic for analysis?

3

Please see attached.

Thank you!

(attachments)

request_1764773371.pcap (1.59 KB)

4

Hello @segers ,

thanks for the pcap. I’ve modified 2010677 to include a negation for the http.host field ending in aquaveo.com. These changes should go live tonight, with our daily rule releases. Provided everything goes smoothly, the daily release is typically available for download after 6pm EST.

Download and install the new ruleset at your convenience, and let us know if you continue experiencing FPs with this rule.

Thanks and happy Friday,

-Tony Robinson

1 Like
5

Thank very much!

1 Like