Closed liquidsec closed 1 year ago
This PR adds or updates the follow signature:
identifiers: cnames: - type: word value: tumblr.com - type: word value: txmblr.com - type: word value: umblr.com ips: [] nameservers: [] not_cnames: [] matcher_rule: matchers: - dsl: - Host != ip type: dsl - condition: and part: body type: word words: - Whatever you were looking for doesn't currently exist at this address. - There's nothing here. - condition: and dsl: - '!contains(host,"tumblr.com")' - '!contains(host,"txmblr.com")' - '!contains(host,"umblr.com")' type: dsl matchers-condition: and mode: http service_name: tumblr takeover detection source: nucleitemplates
Test results:
Signature Pass: true :heavy_check_mark:
Match Table:
blocking in favor of dnsReaper signature
Add or update signature: nucleitemplates_tumblr-takeover.yml
This PR adds or updates the follow signature: