Versions (5)
Version DetailsCurrent
Rev: 5 • Nov 19, 2014, 12:00 PMET EXPLOIT_KIT SPL2 EK PluginDetect Data Hash Nov 18 2014
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT SPL2 EK PluginDetect Data Hash Nov 18 2014"; flow:to_server,established; content:".html?"; http_uri; fast_pattern:only; content:"-"; http_uri; pcre:"/\/[a-z]+?-[a-z]+?-[a-z]+?\.html\?[a-z]+\d*?=[a-f0-9]{32}$/U"; content:"GET "; pcre:"/^[^\r\n]*?(?P<name>\/[^\.\/]+\.html)\?[a-z]+?\d*?=[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(?P=name)(?:\d{1,5})?\r\n/Rs"; classtype:exploit-kit; sid:2019743; rev:5; metadata:created_at 2014_11_19, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Nov 19, 2014, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Dec 29, 2025, 9:34 PM
rules/emerging-exploit_kit.rules