NF – POLICY – Windows XP making Internet connection – IE 8 – Company Policy Violation
The rule detects instances where a host on the internal network (Windows XP) is making an Internet connection using Internet Explorer 8 (IE 8) with a User-Agent header indicating Windows NT 5.1 (Windows XP). This activity is flagged as a potential company policy violation, possibly due to security concerns related to the use of outdated software and operating systems.
ID Number
5017401
Signature
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"NF - POLICY - Windows XP making Internet connection - IE 8 - Company Policy Violation"; flow:established,to_server; content:"User-Agent|3a 20|"; http_header; content:"MSIE 8.0"; nocase; http_header; content:"Windows NT 5.1"; nocase; http_header; fast_pattern:only; reference:url,networkforensic.dk; metadata:22072015; classtype:policy-violation; sid:5017401; rev:2;)
MITRE ATT&CK Technique
-
Severity
High
Recommendations/Investigative actions
Check if it is possible to update the operating system and the browser version.