Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Watering Hole applet name AppletHigh.jar"; flow:established,to_server; http.uri; content:"/AppletHigh.jar"; http.user_agent; content:"Java/1."; reference:url,www.fireeye.com/blog/technical/targeted-attack/2013/03/internet-explorer-8-exploit-found-in-watering-hole-campaign-targeting-chinese-dissidents.html; classtype:exploit-kit; sid:2016639; rev:5; metadata:created_at 2013_03_22, signature_severity Major, updated_at 2020_04_24;)