## snort latest
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB_CLIENT Possible Chrome WebEx Extension RCE Attempt"; flow:to_server,established; content:"cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html"; http_uri; fast_pattern:only; classtype:attempted-user; sid:1002654; rev:1;)

01/23-16:42:28.106488  [**] [1:1002654:1] ET WEB_CLIENT Possible Chrome WebEx Extension RCE Attempt [**] [Classification: Attempted User Privilege Gain] [Priority: 1] {TCP} 172.16.0.132:51470 -> 104.167.101.130:80

## suricata latest
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Possible Chrome WebEx Extension RCE Attempt"; flow:to_server,established; content:"cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html"; http_uri; fast_pattern:only; classtype:attempted-user; sid:1002654; rev:1;)

01/23/2017-16:42:28.251295  [**] [1:1002654:1] ET WEB_CLIENT Possible Chrome WebEx Extension RCE Attempt [**] [Classification: Attempted User Privilege Gain] [Priority: 1] {TCP} 172.16.0.132:51470 -> 104.167.101.130:80