SID 1:17276

Rule Category

FILE-OTHER -- Snort detected traffic targeting vulnerabilities in a file type that does not require enough rule coverage to have its own category.

Alert Message

FILE-OTHER Multiple vendor Antivirus magic byte detection evasion attempt

Rule Explanation

An attacker can specify an incorrect Content-Type when sending a malicious file and cause several antivirus products to misidentify the file type during scans.

What To Look For

This rule triggers on attempt to evade detection in several Antivirus products by incorrectly specifying the file type being scanned.

Known Usage

Public information/Proof of Concept available

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group