Versions (3)
Version DetailsCurrent
Rev: 6 • Mar 30, 2012, 12:00 PMET DELETED Possible Dynamic DNS Exploit Pack Payload
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Dynamic DNS Exploit Pack Payload"; flow:established,to_server; content:".php"; http_uri; content:"quote="; distance:0; http_uri; content:"tid="; http_uri; content:"fid="; http_uri; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2014445; rev:6; metadata:created_at 2012_03_30, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_20;)
Mar 30, 2012, 12:00 PM
Aug 20, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 6, 2025, 9:38 PM
rules/emerging-deleted.rules