Wayback Machine Archival Recon Detected
This rule detects network traffic where the HTTP referer header contains "web.archive.org". This indicates that a user on the internal network is navigating to a website via a link from the Wayback Machine, which could be a sign of reconnaissance activity, where an attacker or insider is researching past versions of a website or looking for historical information that might no longer be publicly available on the live site. The rule specifically looks for established HTTP connections flowing to the server.
Suricata
