Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CVE-2012-4792 EIP in URI M2"; flow:established,to_server; http.uri.raw; content:"/%E0%B4%8C%E1%82%AB"; fast_pattern; http.header; content:"MSIE 8.0|3b|"; reference:cve,2012-4792; reference:url,github.com/rapid7/metasploit-framework/commit/6cb9106218bde56fc5e8d72c66fbba9f11c24449; reference:url,eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/; classtype:attempted-user; sid:2016170; rev:6; metadata:created_at 2013_01_08, signature_severity Unknown, tag CISA_KEV, updated_at 2022_07_13;)