Rule History

SID: 2014575 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 5 • Apr 16, 2012, 12:00 PM

Message:

ET INFO Potential Malicious PDF (EmbeddedFiles) improper case

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Potential Malicious PDF (EmbeddedFiles) improper case"; flow:from_server,established; content:"|0d 0a 0d 0a|%PDF"; content:"/EmbeddedFiles"; within:128; nocase; content:!"/EmbeddedFiles"; distance:-14; within:14; reference:url,blog.didierstevens.com/2009/07/01/embedding-and-hiding-files-in-pdf-documents/; classtype:misc-activity; sid:2014575; rev:5; metadata:attack_target Client_Endpoint, created_at 2012_04_16, deployment Perimeter, confidence High, signature_severity Minor, updated_at 2023_04_20;)

Created:

Apr 16, 2012, 12:00 PM

Updated:

Apr 20, 2023, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-info.rules