Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Sakura Exploit Kit Version 1.1 Archive Request"; flow:established,to_server; http.uri; content:"/getfile.php?i="; content:"&key="; pcre:"/\x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$/i"; reference:url,blog.spiderlabs.com/2012/05/sakura-exploit-kit-11.html; classtype:exploit-kit; sid:2014851; rev:3; metadata:created_at 2012_06_05, signature_severity Major, updated_at 2020_04_21;)