Skip to content
.ca
sign in
detection rulesuricata

ATTACK 'Polly for Sonya' Cyrillic-language Docker pwn tooling marker

First seen
2026-06-16
Last seen
2026-06-16
Used in
1 post
SuricataATTACK 'Polly for Sonya' Cyrillic-language Docker pwn tooling marker
alert http any any -> $HOME_NET any (msg:"ATTACK 'Polly for Sonya' Cyrillic-language Docker pwn tooling marker"; \
  flow:to_server,established; \
  http.method; content:"POST"; \
  http.request_body; content:"by Polly for"; \
  classtype:attempted-admin; sid:1000231006; rev:1; \
  metadata:created_at 2026-05-28;)

Posts using this rule