alert udp $HOME_NET 17500 -> any 17500 (msg:"ET POLICY Dropbox Client Broadcasting"; content:"{|22|host_int|22 3a| "; depth:13; content:" |22|version|22 3a| ["; distance:0; content:"], |22|displayname|22 3a| |22|"; distance:0; threshold:type limit, count 1, seconds 3600, track by_src; classtype:policy-violation; sid:2012648; rev:3;)

Added 2011-10-12 19:34:52 UTC

Please enter documentation, comments, false positives, or concerns with this signature. Press the Attach button below to add samples or Pcaps.

-- PlanktonSpongebob - 2017-05-10

Please enter documentation, comments, false positives, or concerns with this signature. Press the Attach button below to add samples or Pcaps.

-- PlanktonSpongebob - 2017-05-10

Please enter documentation, comments, false positives, or concerns with this signature. Press the Attach button below to add samples or Pcaps.

-- PlanktonSpongebob - 2017-05-10

Apologies for multiple lines!

-- PlanktonSpongebob - 2017-05-10


Topic attachments
I Attachment Action Size Date Who Comment
Unknown file formatpcap sample.dropbox.pcap manage 239.5 K 2017-05-10 - 08:03 PlanktonSpongebob  
Topic revision: r2 - 2017-05-10 - PlanktonSpongebob
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats