Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CritX/SafePack/FlashPack Jar Download Jul 01 2013"; flow:established,to_client; http.header; content:"j51"; nocase; content:".jar"; fast_pattern; pcre:"/^Content-Disposition\x3a[^\r\n]+?=\s*?(?P<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(?P=q)\r?$/m"; reference:url,www.malwaresigs.com/2013/06/14/slight-change-in-flashpack-uri/; classtype:exploit-kit; sid:2017092; rev:4; metadata:created_at 2013_07_02, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_03;)