fix: use explicit CIDR notation for loopback

phantinuss · Aug 25, 2023 · bffbdab · bffbdab
1 parent af05a5b
commit bffbdab
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/rules/web/proxy_generic/proxy_webdav_search_ms.yml b/rules/web/proxy_generic/proxy_webdav_search_ms.yml
@@ -7,6 +7,7 @@ references:
     - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
 author: Micah Babinski
 date: 2023/08/21
+modified: 2023/08/25
 tags:
     - attack.initial_access
     - attack.t1584
@@ -32,7 +33,7 @@ detection:
             - '10.0.0.0/8'
             - '172.16.0.0/12'
             - '192.168.0.0/16'
-            - '::1'  # IPv6 loopback
+            - '::1/128'  # IPv6 loopback
             - 'fe80::/10'  # IPv6 link-local addresses
             - 'fc00::/7'  # IPv6 private addresses
     condition: all of selection_* and not 1 of filter_main_*