Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT ScanBox Framework used in WateringHole Attacks Initial (POST)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:".php"; endswith; http.request_body; content:"seed="; fast_pattern; content:"&referrer="; content:"&agent="; content:"&location="; content:"&toplocation="; reference:url,www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks; classtype:exploit-kit; sid:2019094; rev:8; metadata:created_at 2014_08_30, signature_severity Major, updated_at 2020_09_17;)