Jun 25,  · Then modify rules like “ET Policy PE EXE or DLL Windows file download” to check for that flag. Re: ET Policy PE EXE or DLL Windows file download whitelisting question Ian: 6/25/17 AM: Jon, I’ll take a look at the script, thanks for that, but I’m looking to see if . Jan 31,  · The “ET POLICY” part of the alert is telling you that it’s a ‘Policy’ rule: i.e. it’s not an attack per se, it’s just something which might violate a corporate policy. That particular alert is just telling you that someone has downloaded a Windows executable file or DLL over HTTP. Snort generated an alert and logged the message “ET POLICY PE EXE or DLL Windows file download HTTP” when it detected TCP packets coming from the external network on HTTP ports going into the local network on any ports, or essentially, when a file is downloaded from an external source. TCP packets coming from IP addresses in the external network whose ports were HTTP traveling to IP.
 
 

 

: Free .DLL download. – .Kershaw Befornes

 
The actual problem seems to be that the same IP is trying to get the.