Snort_AIPreproc/corr_rules/1-1292-9.xml

15 lines
443 B
XML

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE hyperalert PUBLIC "-//blacklight//DTD HYPERALERT SNORT MODEL//EN" "http://0x00.ath.cx/hyperalert.dtd">
<hyperalert>
<snort-id>1.1292.9</snort-id>
<desc>ATTACK-RESPONSES directory listing</desc>
<pre>HostExists(+DST_ADDR+)</pre>
<pre>HasService(+DST_ADDR+, +DST_PORT+)</pre>
<pre>HasHttpInfo(+SRC_ADDR+, +DST_ADDR+)</pre>
<post>HasFileInfo(+SRC_ADDR+, +DST_ADDR+)</post>
</hyperalert>