Versions (5)
Version DetailsCurrent
Rev: 3 • Oct 28, 2014, 12:00 PMET EXPLOIT_KIT Likely SweetOrange EK Flash Exploit URI Struct
alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Likely SweetOrange EK Flash Exploit URI Struct"; flow:established,to_server; http.uri; pcre:"/\/(?=[a-z0-9]{0,10}[A-Z])(?=[A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,11}$/"; http.header; content:"x-flash-version|3a|"; fast_pattern; pcre:"/^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+?=\d/m"; classtype:exploit-kit; sid:2019543; rev:3; metadata:created_at 2014_10_28, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_23;)
Oct 28, 2014, 12:00 PM
Feb 23, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 13, 2025, 9:34 PM
rules/emerging-exploit_kit.rules