Rule History

SID: 2018312 • Source: et/open

Versions (5)

Version DetailsCurrent

Rev: 6 • Mar 25, 2014, 12:00 PM

Message:

ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 6

Rule:

alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 6"; flow:from_client,established; content:"cdS01NT"; fast_pattern; pcre:"/^(?:.*?(?:XHUtNTU0|cdS01NT|x1LTU1N)){7}/Rs"; reference:cve,2014-1761; reference:url,blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx; classtype:attempted-user; sid:2018312; rev:6; metadata:created_at 2014_03_25, deprecation_reason Age, confidence Low, signature_severity Major, tag CISA_KEV, updated_at 2023_01_19;)

Created:

Mar 25, 2014, 12:00 PM

Updated:

Jan 19, 2023, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-exploit.rules